diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4d9279a60..7f08cc3aa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -49,6 +49,13 @@ version of it. (Use the `git rebase` or `git commit --amend` commands.)
 For more detailed instructions, see the
 [Gerrit User Guide](https://gerrit-review.googlesource.com/Documentation/intro-user.html).
 
+As an alternative to pushing to `refs/for/main`: if you have Chromium's
+`depot_tools` installed, you can simply run `git cl upload` to upload a change.
+This also has the advantage of automatically running any relevant `PRESUBMIT.py`
+checks. See [depot_tools
+documentation](https://commondatastorage.googleapis.com/chrome-infra-docs/flat/depot_tools/docs/html/depot_tools.html)
+for more info.
+
 ### Copyright headers
 New files contributed directly to BoringSSL should use the following copyright
 header, where `YEAR` is the year the file was added:
diff --git a/infra/config/PRESUBMIT.py b/infra/config/PRESUBMIT.py
new file mode 100644
index 000000000..6d138da3e
--- /dev/null
+++ b/infra/config/PRESUBMIT.py
@@ -0,0 +1,24 @@
+# Copyright 2025 The BoringSSL Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Enforces consistency in lucicfg definitions for BoringSSL's CI and CQ.
+
+Run by the presubmit API in depot_tools, e.g. by running `git cl presubmit`.
+"""
+
+PRESUBMIT_VERSION = '2.0.0'
+
+def CheckLucicfgGenOutputMain(input_api, output_api):
+  return input_api.RunTests(input_api.canned_checks.CheckLucicfgGenOutput(
+      input_api, output_api, 'main.star'))
diff --git a/infra/config/main.star b/infra/config/main.star
index 111598884..6cbe93cf9 100755
--- a/infra/config/main.star
+++ b/infra/config/main.star
@@ -130,6 +130,17 @@ def ci_builder(
         short_name = None,
         execution_timeout = None,
         properties = {}):
+    """Defines a CI builder.
+
+    Args:
+      name: The name to use for the builder.
+      host: The host to run on.
+      recipe: The recipe to run.
+      category: Category in which to display the builder in the console view.
+      short_name: The short name for the builder in the console view.
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     dimensions = dict(host["dimensions"])
     dimensions["pool"] = "luci.flex.ci"
     caches = [swarming.cache("gocache"), swarming.cache("gopath")]
@@ -170,6 +181,17 @@ def cq_builder(
         cq_enabled = True,
         execution_timeout = None,
         properties = {}):
+    """Defines a CQ builder.
+
+    Args:
+      name: The name to use for the builder.
+      host: The host to run on.
+      recipe: The recipe to run.
+      cq_enabled: Whether the try builder is enabled by default. (If false,
+        the builder is includable_only.)
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     dimensions = dict(host["dimensions"])
     dimensions["pool"] = "luci.flex.try"
     if execution_timeout == None:
@@ -220,6 +242,24 @@ def both_builders(
         cq_compile_only = None,
         execution_timeout = None,
         properties = {}):
+    """Defines both a CI builder and similarly-configured CQ builder.
+
+    Args:
+      name: The name to use for both builders.
+      host: The host to run on.
+      recipe: The recipe to run.
+      category: Category in which to display the builder in the console view.
+      short_name: The short name for the builder in the console view.
+      cq_enabled: Whether the try builder is enabled by default. (If false,
+        the builder is includable_only.)
+      cq_compile_only: If cq_compile_only is specified, we generate both a
+        disabled builder that matches the CI builder, and a compile-only
+        builder. The compile-only builder is controlled by cq_enabled.
+        cq_compile_only also specifies the host to run on, because the
+        compile-only builder usually has weaker requirements.
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     ci_builder(
         name,
         host,
@@ -230,11 +270,6 @@ def both_builders(
         properties = properties,
     )
 
-    # If cq_compile_only is specified, we generate both a disabled builder that
-    # matches the CI builder, and a compile-only builder. The compile-only
-    # builder is controlled by cq_enabled. cq_compile_only also specifies the
-    # host to run on, because the compile-only builder usually has weaker
-    # requirements.
     cq_builder(
         name,
         host,
@@ -381,7 +416,6 @@ both_builders(
     },
 )
 
-
 # delocate works on aarch64. Test this by also building the static library mode
 # for android_aarch64_fips. Additionally, urandom_test doesn't work in shared
 # library builds, so this gives Android FIPS coverage for urandom_test.
@@ -794,6 +828,7 @@ both_builders(
         },
     },
 )
+
 # TODO(crbug.com/42290446): Enable on both CQ and CI.
 cq_builder(
     "linux_rust",