diff --git a/gclient_scm.py b/gclient_scm.py
index 031bba4bd..47b0ddc4f 100644
--- a/gclient_scm.py
+++ b/gclient_scm.py
@@ -21,8 +21,10 @@ import traceback
 
 import gclient_utils
 import gerrit_util
+import git_auth
 import git_cache
 import git_common
+import newauth
 import scm
 import subprocess2
 
@@ -1321,6 +1323,10 @@ class GitWrapper(SCMWrapper):
         parent_dir = os.path.dirname(self.checkout_path)
         gclient_utils.safe_makedirs(parent_dir)
 
+        # Set up Git authentication configuration that is needed to clone/fetch the repo.
+        if newauth.Enabled():
+            git_auth.ConfigureGlobal('/', url)
+
         if hasattr(options, 'no_history') and options.no_history:
             self._Run(['init', self.checkout_path], options, cwd=self._root_dir)
             self._Run(['remote', 'add', 'origin', url], options)
diff --git a/git_auth.py b/git_auth.py
index e8b28a5a4..645ee4756 100644
--- a/git_auth.py
+++ b/git_auth.py
@@ -108,6 +108,20 @@ class ConfigChanger(object):
             remote_url=remote_url,
         )
 
+    @classmethod
+    def new_for_remote(cls, cwd: str, remote_url: str) -> ConfigChanger:
+        """Create a ConfigChanger for the given Gerrit host.
+
+        The user, which is used to determine the mode, is inferred using
+        git-config(1) in the given `cwd`.
+        """
+        c = cls(
+            mode=ConfigMode.NEW_AUTH,
+            remote_url=remote_url,
+        )
+        c.mode = cls._infer_mode(cwd, c._shortname + '-review.googlesource.com')
+        return c
+
     @staticmethod
     def _infer_mode(cwd: str, gerrit_host: str) -> ConfigMode:
         """Infer default mode to use."""
@@ -280,6 +294,12 @@ def Configure(cwd: str, cl: git_cl.Changelist) -> None:
     c2.apply(cwd)
 
 
+def ConfigureGlobal(cwd: str, remote_url: str) -> None:
+    """Configure global/user Git authentication."""
+    logging.debug('Configuring global Git authentication for %s', remote_url)
+    ConfigChanger.new_for_remote(cwd, remote_url).apply_global(cwd)
+
+
 def ClearRepoConfig(cwd: str, cl: git_cl.Changelist) -> None:
     """Clear the current Git repo authentication."""
     logging.debug('Clearing current Git repo authentication...')