diff --git a/infra/config/generated/cr-buildbucket.cfg b/infra/config/generated/cr-buildbucket.cfg
index 01ab643..51c0ff6 100644
--- a/infra/config/generated/cr-buildbucket.cfg
+++ b/infra/config/generated/cr-buildbucket.cfg
@@ -73,6 +73,18 @@
       }
     }
   }
+  shadow: "ci.shadow"
+}
+buckets {
+  name: "ci.shadow"
+  acls {
+    group: "all"
+  }
+  constraints {
+    pools: "luci.flex.ci"
+    service_accounts: "gn-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  dynamic_builder_template {}
 }
 buckets {
   name: "try"
@@ -151,4 +163,16 @@
       }
     }
   }
+  shadow: "try.shadow"
+}
+buckets {
+  name: "try.shadow"
+  acls {
+    group: "all"
+  }
+  constraints {
+    pools: "luci.flex.try"
+    service_accounts: "gn-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  dynamic_builder_template {}
 }
diff --git a/infra/config/generated/project.cfg b/infra/config/generated/project.cfg
index 0462da7..bb145a6 100644
--- a/infra/config/generated/project.cfg
+++ b/infra/config/generated/project.cfg
@@ -7,7 +7,7 @@
 name: "gn"
 access: "group:all"
 lucicfg {
-  version: "1.45.3"
+  version: "1.45.6"
   package_dir: ".."
   config_dir: "generated"
   entry_point: "main.star"
diff --git a/infra/config/generated/realms.cfg b/infra/config/generated/realms.cfg
index e9445b7..b75c130 100644
--- a/infra/config/generated/realms.cfg
+++ b/infra/config/generated/realms.cfg
@@ -39,6 +39,17 @@
   }
 }
 realms {
+  name: "ci.shadow"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:gn-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  bindings {
+    role: "role/buildbucket.creator"
+    principals: "group:project-gn-committers"
+  }
+}
+realms {
   name: "try"
   bindings {
     role: "role/buildbucket.builderServiceAccount"
@@ -54,3 +65,14 @@
     principals: "group:flex-try-led-users"
   }
 }
+realms {
+  name: "try.shadow"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:gn-try-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  bindings {
+    role: "role/buildbucket.creator"
+    principals: "group:project-gn-committers"
+  }
+}
diff --git a/infra/config/main.star b/infra/config/main.star
index e988e49..0fb49df 100755
--- a/infra/config/main.star
+++ b/infra/config/main.star
@@ -89,6 +89,28 @@
     ),
 ])
 
+# Shadow bucket for led.
+luci.bucket(
+    name = "ci.shadow",
+    shadows = "ci",
+    constraints = luci.bucket_constraints(
+        pools = ["luci.flex.ci"],
+        service_accounts = [
+            "gn-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
+    ),
+    bindings = [
+        # for led permissions.
+        luci.binding(
+            roles = "role/buildbucket.creator",
+            groups = [
+                "project-gn-committers",
+            ],
+        ),
+    ],
+    dynamic = True,
+)
+
 def ci_builder(name, os, caches = None):
     builder(name, "ci", os, caches, triggered_by = ["gn-trigger"])
     luci.console_view_entry(
@@ -139,6 +161,28 @@
     ),
 ])
 
+# Shadow bucket for led.
+luci.bucket(
+    name = "try.shadow",
+    shadows = "try",
+    constraints = luci.bucket_constraints(
+        pools = ["luci.flex.try"],
+        service_accounts = [
+            "gn-try-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
+    ),
+    bindings = [
+        # for led permissions.
+        luci.binding(
+            roles = "role/buildbucket.creator",
+            groups = [
+                "project-gn-committers",
+            ],
+        ),
+    ],
+    dynamic = True,
+)
+
 luci.binding(
     realm = "try",
     roles = "role/swarming.taskTriggerer",