diff --git a/jenkins-docker/master/gerrit-ci-scripts-manual.xml b/jenkins-docker/master/gerrit-ci-scripts-manual.xml
index 141946c..afebc71 100644
--- a/jenkins-docker/master/gerrit-ci-scripts-manual.xml
+++ b/jenkins-docker/master/gerrit-ci-scripts-manual.xml
@@ -29,7 +29,8 @@
     <userRemoteConfigs>
       <hudson.plugins.git.UserRemoteConfig>
         <refspec>+refs/changes/*:refs/remotes/origin/*</refspec>
-        <url>https://gerrit-review.googlesource.com/gerrit-ci-scripts</url>
+        <url>https://gerrit-review.googlesource.com/a/gerrit-ci-scripts</url>
+        <credentialsId>gerrit.googlesource.com</credentialsId>
       </hudson.plugins.git.UserRemoteConfig>
     </userRemoteConfigs>
     <branches>
diff --git a/jenkins-docker/master/gerrit-ci-scripts.xml b/jenkins-docker/master/gerrit-ci-scripts.xml
index 7921b59..1b8e018 100644
--- a/jenkins-docker/master/gerrit-ci-scripts.xml
+++ b/jenkins-docker/master/gerrit-ci-scripts.xml
@@ -14,7 +14,8 @@
     <configVersion>2</configVersion>
     <userRemoteConfigs>
       <hudson.plugins.git.UserRemoteConfig>
-        <url>https://gerrit.googlesource.com/gerrit-ci-scripts</url>
+        <url>https://gerrit.googlesource.com/a/gerrit-ci-scripts</url>
+        <credentialsId>gerrit.googlesource.com</credentialsId>
       </hudson.plugins.git.UserRemoteConfig>
     </userRemoteConfigs>
     <branches>
diff --git a/jenkins/gerrit-app-analytics-etl.yaml b/jenkins/gerrit-app-analytics-etl.yaml
index dabe859..e456afb 100644
--- a/jenkins/gerrit-app-analytics-etl.yaml
+++ b/jenkins/gerrit-app-analytics-etl.yaml
@@ -8,6 +8,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -19,9 +24,10 @@
             - job-extended-read
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/apps/{name}
+                url: https://gerrit.googlesource.com/a/apps/{name}
           branches:
             - origin/{branch}
           submodule:
@@ -31,6 +37,7 @@
       - pollscm:
           cron: 'H/50 * * * *'
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-sbt-build-app.sh
     publishers:
       - archive:
diff --git a/jenkins/gerrit-app-template.yaml b/jenkins/gerrit-app-template.yaml
index 21fb681..0c6e3b4 100644
--- a/jenkins/gerrit-app-template.yaml
+++ b/jenkins/gerrit-app-template.yaml
@@ -19,7 +19,8 @@
       - git:
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/apps/{name}
+                url: https://gerrit.googlesource.com/a/apps/{name}
+                credentials-id: gerrit.googlesource.com
           branches:
             - origin/{branch}
           submodule:
diff --git a/jenkins/gerrit-bazel-build-its-plugin-branch.sh b/jenkins/gerrit-bazel-build-its-plugin-branch.sh
index f81ff5d..a1d2cf5 100644
--- a/jenkins/gerrit-bazel-build-its-plugin-branch.sh
+++ b/jenkins/gerrit-bazel-build-its-plugin-branch.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-git remote add origin https://gerrit.googlesource.com/gerrit
+git remote add origin https://gerrit.googlesource.com/a/gerrit
 git fetch origin
 git checkout origin/{gerrit-branch}
 git submodule update --init
diff --git a/jenkins/gerrit-bazel-build-plugin-branch.sh b/jenkins/gerrit-bazel-build-plugin-branch.sh
index 7a85001..f53f569 100644
--- a/jenkins/gerrit-bazel-build-plugin-branch.sh
+++ b/jenkins/gerrit-bazel-build-plugin-branch.sh
@@ -4,7 +4,7 @@
 
 echo "Building plugin {name}/{branch} with Gerrit/{gerrit-branch}"
 
-git remote add gerrit https://gerrit.googlesource.com/gerrit
+git remote add gerrit https://gerrit.googlesource.com/a/gerrit
 git fetch gerrit {gerrit-branch}
 git checkout -fb {gerrit-branch} gerrit/{gerrit-branch}
 git submodule update --init
diff --git a/jenkins/gerrit-bazel-build-plugin-manual.sh b/jenkins/gerrit-bazel-build-plugin-manual.sh
index c7235e8..7abae7d 100644
--- a/jenkins/gerrit-bazel-build-plugin-manual.sh
+++ b/jenkins/gerrit-bazel-build-plugin-manual.sh
@@ -3,7 +3,7 @@
 git checkout -fb {branch} gerrit/{branch}
 git submodule update --init
 rm -rf plugins/{name}
-git fetch https://gerrit.googlesource.com/plugins/{name} $REFS_CHANGE
+git fetch https://gerrit.googlesource.com/a/plugins/{name} $REFS_CHANGE
 git read-tree -u --prefix=plugins/{name} FETCH_HEAD
 
 if [ -f plugins/{name}/external_plugin_deps.bzl ]
diff --git a/jenkins/gerrit-bazel-plugin-account.yaml b/jenkins/gerrit-bazel-plugin-account.yaml
index 054dfd2..a34139b 100644
--- a/jenkins/gerrit-bazel-plugin-account.yaml
+++ b/jenkins/gerrit-bazel-plugin-account.yaml
@@ -7,17 +7,25 @@
     project-name: plugins%2Faccount
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
             recursive: true
           skip-tag: true
+    wrappers:
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-account-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
diff --git a/jenkins/gerrit-bazel-plugin-examples.yaml b/jenkins/gerrit-bazel-plugin-examples.yaml
index 3394ee4..76d4286 100644
--- a/jenkins/gerrit-bazel-plugin-examples.yaml
+++ b/jenkins/gerrit-bazel-plugin-examples.yaml
@@ -5,13 +5,21 @@
     targets: ''
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/examples
+                url: https://gerrit.googlesource.com/a/plugins/examples
           branches:
             - origin/{branch}
           skip-tag: true
+    wrappers:
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-examples-plugin.sh
     publishers:
       - archive:
diff --git a/jenkins/gerrit-bazel-plugin-gh-template.yaml b/jenkins/gerrit-bazel-plugin-gh-template.yaml
index 1f22279..bbab833 100644
--- a/jenkins/gerrit-bazel-plugin-gh-template.yaml
+++ b/jenkins/gerrit-bazel-plugin-gh-template.yaml
@@ -6,6 +6,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -21,7 +26,8 @@
             - origin:
                 url: https://github.com/{organization}/{repo}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
+                credentials-id: gerrit.googlesource.com
           branches:
             - origin/{branch}
           submodule:
@@ -38,6 +44,7 @@
       and hosted on GitHub
     defaults: plugin-gh-template
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
       - shell: !include-raw: gerrit-bazel-gh-get-plugin-info.sh
     publishers:
diff --git a/jenkins/gerrit-bazel-plugin-gitblit.yaml b/jenkins/gerrit-bazel-plugin-gitblit.yaml
index c137bd9..472d83d 100644
--- a/jenkins/gerrit-bazel-plugin-gitblit.yaml
+++ b/jenkins/gerrit-bazel-plugin-gitblit.yaml
@@ -5,6 +5,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -16,13 +21,14 @@
             - job-extended-read
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/gitblit
+                url: https://gerrit.googlesource.com/a/plugins/gitblit
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
             - gitblit:
-                url: https://gerrit.googlesource.com/gitblit
+                url: https://gerrit.googlesource.com/a/gitblit
           branches:
             - origin/{branch}
           submodule:
@@ -41,19 +47,21 @@
     node: bazel-debian
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/gitblit
+                url: https://gerrit.googlesource.com/a/plugins/gitblit
             - gitblit:
-                url: https://gerrit.googlesource.com/gitblit
+                url: https://gerrit.googlesource.com/a/gitblit
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
             recursive: true
           skip-tag: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gitblit-ant-build.sh
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
diff --git a/jenkins/gerrit-bazel-plugin-its-template.yaml b/jenkins/gerrit-bazel-plugin-its-template.yaml
index 45ff57d..b85699d 100644
--- a/jenkins/gerrit-bazel-plugin-its-template.yaml
+++ b/jenkins/gerrit-bazel-plugin-its-template.yaml
@@ -6,6 +6,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -17,13 +22,14 @@
             - job-extended-read
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - plugin:
-                url: https://gerrit.googlesource.com/plugins/its-{name}
+                url: https://gerrit.googlesource.com/a/plugins/its-{name}
             - origin:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
             - base:
-                url: https://gerrit.googlesource.com/plugins/its-base
+                url: https://gerrit.googlesource.com/a/plugins/its-base
           branches:
             - plugin/{branch}
           submodule:
@@ -40,6 +46,7 @@
     defaults: plugin-its-template
     node: bazel-debian
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-its-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-its-plugin-info.sh
     publishers:
@@ -55,11 +62,12 @@
     node: bazel-debian
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - plugin:
-                url: https://gerrit.googlesource.com/plugins/its-{name}
+                url: https://gerrit.googlesource.com/a/plugins/its-{name}
             - base:
-                url: https://gerrit.googlesource.com/plugins/its-base
+                url: https://gerrit.googlesource.com/a/plugins/its-base
           branches:
             - plugin/{branch}
           skip-tag: true
diff --git a/jenkins/gerrit-bazel-plugin-javamelody.yaml b/jenkins/gerrit-bazel-plugin-javamelody.yaml
index fd274dc..acfb03f 100644
--- a/jenkins/gerrit-bazel-plugin-javamelody.yaml
+++ b/jenkins/gerrit-bazel-plugin-javamelody.yaml
@@ -4,11 +4,12 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -16,6 +17,7 @@
           skip-tag: true
           do-not-fetch-tags: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
     publishers:
       - archive:
diff --git a/jenkins/gerrit-bazel-plugin-manual-template.yaml b/jenkins/gerrit-bazel-plugin-manual-template.yaml
index a6aa115..efe07d1 100644
--- a/jenkins/gerrit-bazel-plugin-manual-template.yaml
+++ b/jenkins/gerrit-bazel-plugin-manual-template.yaml
@@ -10,6 +10,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -26,11 +31,12 @@
           override-build-parameters: true
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
         branches:
           - origin/{branch}
         submodule:
@@ -42,6 +48,7 @@
     description: 'Plugin {name} {branch} manual branch build with Bazel'
     defaults: pluginmanual-template
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin-manual.sh
     publishers:
       - archive:
diff --git a/jenkins/gerrit-bazel-plugin-owners.yaml b/jenkins/gerrit-bazel-plugin-owners.yaml
index 98b9be6..030ea88 100644
--- a/jenkins/gerrit-bazel-plugin-owners.yaml
+++ b/jenkins/gerrit-bazel-plugin-owners.yaml
@@ -4,11 +4,12 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -16,6 +17,7 @@
           skip-tag: true
           do-not-fetch-tags: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-owners-plugin.sh
     publishers:
       - archive:
@@ -29,11 +31,12 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -42,6 +45,7 @@
           do-not-fetch-tags: true
     project-name: plugins%2Fowners
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-owners-plugin-branch.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
diff --git a/jenkins/gerrit-bazel-plugin-scripting-template.yaml b/jenkins/gerrit-bazel-plugin-scripting-template.yaml
index a9f752c..197066f 100644
--- a/jenkins/gerrit-bazel-plugin-scripting-template.yaml
+++ b/jenkins/gerrit-bazel-plugin-scripting-template.yaml
@@ -6,6 +6,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -17,11 +22,12 @@
             - job-extended-read
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/scripting/{name}
+                url: https://gerrit.googlesource.com/a/plugins/scripting/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -37,15 +43,17 @@
     defaults: plugin-scripting-template
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/scripting/{name}
+                url: https://gerrit.googlesource.com/a/plugins/scripting/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           skip-tag: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-scripting-plugin-info.sh
     publishers:
@@ -59,13 +67,15 @@
     defaults: plugin-scripting-template
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/scripting/{name}
+                url: https://gerrit.googlesource.com/a/plugins/scripting/{name}
           branches:
             - origin/{branch}
           skip-tag: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin-branch.sh
       - shell: !include-raw: gerrit-bazel-get-scripting-plugin-info.sh
     publishers:
diff --git a/jenkins/gerrit-bazel-plugin-template.yaml b/jenkins/gerrit-bazel-plugin-template.yaml
index d5bba0d..939a733 100644
--- a/jenkins/gerrit-bazel-plugin-template.yaml
+++ b/jenkins/gerrit-bazel-plugin-template.yaml
@@ -6,6 +6,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -30,7 +35,7 @@
     scm:
       - gerrit:
           url: https://gerrit-review.googlesource.com/a/plugins/{name}
-          credentials-id: gerrit-review.googlesource.com
+          credentials-id: gerrit.googlesource.com
           refspecs:
             - '+refs/heads/*:refs/remotes/origin/*'
           filter-checks:
@@ -51,11 +56,12 @@
     project-name: plugins%2F{name}
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -63,6 +69,7 @@
           skip-tag: true
           do-not-fetch-tags: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
@@ -80,13 +87,15 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
           branches:
             - '*/{branch}'
           skip-tag: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin-branch.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
@@ -104,13 +113,15 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/modules/{name}
+                url: https://gerrit.googlesource.com/a/modules/{name}
           branches:
             - '*/{branch}'
           skip-tag: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin-branch.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
@@ -128,16 +139,18 @@
     defaults: plugin-template-bazel
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/modules/{name}
+                url: https://gerrit.googlesource.com/a/modules/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - '*/{branch}'
           skip-tag: true
           do-not-fetch-tags: true
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build-plugin.sh
       - shell: !include-raw: gerrit-bazel-get-project-info.sh
     publishers:
diff --git a/jenkins/gerrit-bazel-template.yaml b/jenkins/gerrit-bazel-template.yaml
index b8b78e9..b34ee3b 100644
--- a/jenkins/gerrit-bazel-template.yaml
+++ b/jenkins/gerrit-bazel-template.yaml
@@ -12,7 +12,8 @@
             - job-extended-read
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gerrit
+          url: https://gerrit.googlesource.com/a/gerrit
+          credentials-id: gerrit.googlesource.com
           branches:
             - origin/{branch}
           submodule:
@@ -37,7 +38,13 @@
           additional-options: -fbdir /tmp
           debug: true
           shutdown-with-build: false
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     builders:
+      - set-git-credentials
       - shell: !include-raw: gerrit-bazel-build.sh
       - shell: !include-raw-escape: set-docker-host.sh
       - shell: !include-raw: gerrit-bazel-test.sh
diff --git a/jenkins/gerrit-ci-scripts.yaml b/jenkins/gerrit-ci-scripts.yaml
index e3f6e09..3c815bc 100644
--- a/jenkins/gerrit-ci-scripts.yaml
+++ b/jenkins/gerrit-ci-scripts.yaml
@@ -4,7 +4,8 @@
     node: master
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gerrit-ci-scripts
+          url: https://gerrit.googlesource.com/a/gerrit-ci-scripts
+          credentials-id: gerrit.googlesource.com
           branches:
             - '*/master'
           skip-tag: true
@@ -20,7 +21,8 @@
     node: master
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gerrit-ci-scripts
+          url: https://gerrit.googlesource.com/a/gerrit-ci-scripts
+          credentials-id: gerrit.googlesource.com
           branches:
             - '*/master'
           skip-tag: true
@@ -68,7 +70,8 @@
           override-build-parameters: true
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gerrit-ci-scripts
+          url: https://gerrit.googlesource.com/a/gerrit-ci-scripts
+          credentials-id: gerrit.googlesource.com
           refspec: +refs/changes/*:refs/remotes/origin/*
           branches:
             - '${CHANGE_COMMIT}'
@@ -89,7 +92,7 @@
     scm:
       - gerrit:
           url: https://gerrit-review.googlesource.com/a/gerrit-ci-scripts
-          credentials-id: gerrit-review.googlesource.com
+          credentials-id: gerrit.googlesource.com
           refspecs:
             - '+refs/heads/*:refs/remotes/@{remote}/*'
             - '+refs/changes/*:refs/remotes/@{remote}/*'
diff --git a/jenkins/gerrit-mvn-plugin-template.yaml b/jenkins/gerrit-mvn-plugin-template.yaml
index 050a226..e9abb86 100644
--- a/jenkins/gerrit-mvn-plugin-template.yaml
+++ b/jenkins/gerrit-mvn-plugin-template.yaml
@@ -7,6 +7,11 @@
           timeout: 30
           fail: true
       - timestamps
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
     properties:
       - build-discarder:
           days-to-keep: 20
@@ -18,11 +23,12 @@
             - job-extended-read
     scm:
       - git:
+          credentials-id: gerrit.googlesource.com
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{repo}
+                url: https://gerrit.googlesource.com/a/plugins/{repo}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
@@ -32,6 +38,7 @@
       - pollscm:
           cron: 'H/50 * * * *'
     builders:
+      - set-git-credentials
       - shell:
           !include-raw: gerrit-mvn-build-plugin.sh
     publishers:
diff --git a/jenkins/gerrit-sbt-plugin-template.yaml b/jenkins/gerrit-sbt-plugin-template.yaml
index 64328d6..94859d1 100644
--- a/jenkins/gerrit-sbt-plugin-template.yaml
+++ b/jenkins/gerrit-sbt-plugin-template.yaml
@@ -19,9 +19,9 @@
       - git:
           remotes:
             - origin:
-                url: https://gerrit.googlesource.com/plugins/{name}
+                url: https://gerrit.googlesource.com/a/plugins/{name}
             - gerrit:
-                url: https://gerrit.googlesource.com/gerrit
+                url: https://gerrit.googlesource.com/a/gerrit
           branches:
             - origin/{branch}
           submodule:
diff --git a/jenkins/gerrit-verifier.yaml b/jenkins/gerrit-verifier.yaml
index dc69949..2e541ab 100644
--- a/jenkins/gerrit-verifier.yaml
+++ b/jenkins/gerrit-verifier.yaml
@@ -1,4 +1,12 @@
 - builder:
+    name: set-git-credentials
+    builders:
+      - shell: |
+          #!/bin/bash -e
+          echo "machine gerrit.googlesource.com login $GS_GIT_USER password $GS_GIT_PASS">> ~/.netrc
+          chmod 600 ~/.netrc
+
+- builder:
     name: merge-target-branch
     builders:
       - shell: |
@@ -67,7 +75,8 @@
           days-to-keep: 30
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gerrit
+          url: https://gerrit.googlesource.com/a/gerrit
+          credentials-id: gerrit.googlesource.com
           refspec: $REFSPEC
           branches:
             - $BRANCH
@@ -85,6 +94,11 @@
           additional-options: -fbdir /tmp
           debug: true
           shutdown-with-build: false
+      - credentials-binding:
+          - username-password-separated:
+              credential-id: gerrit.googlesource.com
+              username: GS_GIT_USER
+              password: GS_GIT_PASS
       - raw:
           xml: |
             <hudson.plugins.build__timeout.BuildTimeoutWrapper plugin="build-timeout@1.16">
@@ -111,6 +125,7 @@
           properties-content: >
             BAZEL_OPTS=--remote_cache=https://gerrit-ci.gerritforge.com/cache
     builders:
+      - set-git-credentials
       - merge-target-branch
       - fetch-all-submodules
       - shell: !include-raw-escape: gerrit-bazel-build.sh
@@ -135,6 +150,7 @@
           properties-content: >
             BAZEL_OPTS=--remote_cache=https://gerrit-ci.gerritforge.com/cache
     builders:
+      - set-git-credentials
       - merge-target-branch
       - fetch-all-submodules
       - shell: !include-raw-escape: gerrit-bazel-build.sh
@@ -162,6 +178,7 @@
     defaults: verifier-defaults
     node: bazel-debian
     builders:
+      - set-git-credentials
       - merge-target-branch
       - fetch-all-submodules
       - shell: !include-raw-escape: gerrit-codestyle-gjf.sh
@@ -180,7 +197,7 @@
     scm:
       - gerrit:
           url: https://gerrit-review.googlesource.com/a/gerrit
-          credentials-id: gerrit-review.googlesource.com
+          credentials-id: gerrit.googlesource.com
           refspecs:
             - '+refs/heads/*:refs/remotes/@{remote}/*'
           filter-checks:
diff --git a/jenkins/gitiles-webapp.yaml b/jenkins/gitiles-webapp.yaml
index 3fe28e7..ff91751 100644
--- a/jenkins/gitiles-webapp.yaml
+++ b/jenkins/gitiles-webapp.yaml
@@ -17,7 +17,8 @@
             - job-extended-read
     scm:
       - git:
-          url: https://gerrit.googlesource.com/gitiles
+          credentials-id: gerrit.googlesource.com
+          url: https://gerrit.googlesource.com/a/gitiles
           branches:
             - master
           skip-tag: true
diff --git a/jenkins/homepage.yaml b/jenkins/homepage.yaml
index 4fb82d6..a865cde 100644
--- a/jenkins/homepage.yaml
+++ b/jenkins/homepage.yaml
@@ -4,7 +4,8 @@
     pipeline-scm:
       scm:
         - git:
-            url: https://gerrit.googlesource.com/homepage
+            credentials-id: gerrit.googlesource.com
+            url: https://gerrit.googlesource.com/a/homepage
             branches:
               - master
     triggers:
diff --git a/vars/gerritPipeline.groovy b/vars/gerritPipeline.groovy
index cec06cd..e174847 100644
--- a/vars/gerritPipeline.groovy
+++ b/vars/gerritPipeline.groovy
@@ -121,7 +121,7 @@
 }
 
 def queryChangedFiles(url) {
-    def queryUrl = "${url}changes/${env.GERRIT_CHANGE_NUMBER}/revisions/${env.GERRIT_PATCHSET_REVISION}/files/"
+    def queryUrl = "${url}a/changes/${env.GERRIT_CHANGE_NUMBER}/revisions/${env.GERRIT_PATCHSET_REVISION}/files/"
     def response = httpRequest(url: queryUrl, authentication: env.GERRIT_CREDENTIALS_ID)
     def files = response.getContent().substring(5)
     def filesJson = new JsonSlurper().parseText(files)
diff --git a/vars/pluginPipeline.groovy b/vars/pluginPipeline.groovy
index 217a935..bd43a77 100644
--- a/vars/pluginPipeline.groovy
+++ b/vars/pluginPipeline.groovy
@@ -34,7 +34,7 @@
     def pluginName = parm.name ?: "${env.GERRIT_PROJECT}".split('/').last()
     def formatCheck = parm.formatCheckId
     def buildCheck = parm.buildCheckId
-    def pluginScmUrl = "https://gerrit.googlesource.com/${env.GERRIT_PROJECT}"
+    def pluginScmUrl = "https://gerrit.googlesource.com/a/${env.GERRIT_PROJECT}"
     def gjfVersion = '1.7'
 
     echo "Starting pipeline for plugin '${pluginName}'" + (formatCheck ? " formatCheckId=${formatCheck}" : '') + (buildCheck ? " buildCheckId=${buildCheck}" : '')
@@ -47,8 +47,12 @@
         stages {
             stage('Checkout') {
                 steps {
-                    sh "git clone -b ${env.GERRIT_BRANCH} ${pluginScmUrl}"
-                    sh "cd ${pluginName} && git fetch origin refs/changes/${BRANCH_NAME} && git config user.name jenkins && git config user.email jenkins@gerritforge.com && git merge FETCH_HEAD"
+                    withCredentials([usernamePassword(usernameVariable: "GS_GIT_USER", passwordVariable: "GS_GIT_PASS", credentialsId: env.GERRIT_CREDENTIALS_ID)]) {
+                        sh 'echo "machine gerrit.googlesource.com login $GS_GIT_USER password $GS_GIT_PASS">> ~/.netrc'
+                        sh 'chmod 600 ~/.netrc'
+                        sh "git clone -b ${env.GERRIT_BRANCH} ${pluginScmUrl}"
+                        sh "cd ${pluginName} && git fetch origin refs/changes/${BRANCH_NAME} && git config user.name jenkins && git config user.email jenkins@gerritforge.com && git merge FETCH_HEAD"
+                    }
                 }
             }
             stage('Formatting') {