diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 56c7c0b08..193ddad60 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -52,6 +52,8 @@ test:lint:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -63,6 +65,8 @@ test:js:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -75,6 +79,8 @@ test:build:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -86,6 +92,8 @@ test:native-android:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - !reference [.snippets, install-android-sdk]
@@ -105,6 +113,8 @@ test:native-ios:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -117,6 +127,8 @@ test:native-ios-sr:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -129,6 +141,8 @@ test:native-ios-newarch:
     stage: test
     rules:
         - if: '$BUILD_BENCHMARK != "true"'
+          when: manual
+          allow_failure: true
     timeout: 1h
     script:
         - yarn
@@ -142,6 +156,9 @@ benchmark:
           allow_failure: true
         - if: '$CI_COMMIT_BRANCH == $DEVELOP_BRANCH'
           allow_failure: true
+        # TEST ONLY: allow the benchmark pipeline to run on any branch
+        - if: '$CI_COMMIT_BRANCH'
+          allow_failure: true
     trigger:
         include: 'benchmarks/.benchmarks-ci.yml'
         strategy: depend
diff --git a/benchmarks/.benchmarks-ci.yml b/benchmarks/.benchmarks-ci.yml
index d0b23a1d7..f51d025c7 100644
--- a/benchmarks/.benchmarks-ci.yml
+++ b/benchmarks/.benchmarks-ci.yml
@@ -65,6 +65,20 @@ build-and-upload:app:
   tags: ['macos:tart']
   image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest"
   script:
+    - echo "=== DEBUG AWS env ==="
+    - echo "AWS_REGION=$AWS_REGION"
+    - echo "AWS_EC2_METADATA_SERVICE_ENDPOINT=$AWS_EC2_METADATA_SERVICE_ENDPOINT"
+    - env | grep -iE 'AWS_|VAULT' || true
+    - echo "=== DEBUG IAM proxy role ==="
+    - curl -sS "$AWS_EC2_METADATA_SERVICE_ENDPOINT/latest/meta-data/iam/security-credentials/" -w "\nHTTP %{http_code}\n" || echo "curl failed"
+    - echo "=== DEBUG IAM proxy creds (assume) ==="
+    - ROLE=$(curl -sS "$AWS_EC2_METADATA_SERVICE_ENDPOINT/latest/meta-data/iam/security-credentials/")
+    - echo "role=$ROLE"
+    - curl -sS "$AWS_EC2_METADATA_SERVICE_ENDPOINT/latest/meta-data/iam/security-credentials/$ROLE" -w "\nHTTP %{http_code}\n" 2>&1 | sed -E 's/("SecretAccessKey"|"Token"):"[^"]*"/\1:"REDACTED"/g' || echo "curl failed"
+    - echo "=== DEBUG aws sts ==="
+    - aws sts get-caller-identity || echo ">>> aws sts FAILED - no creds"
+    - echo "=== DEBUG aws cli version ==="
+    - aws --version || true
     - !reference [.snippets, install-node]
     - !reference [.snippets, install-android-sdk]
     - !reference [.snippets, install-jdk-17]
@@ -107,10 +121,11 @@ build-and-upload:app:
     - ./scripts/build-ios-benchmark.sh | tee -a $XCODEBUILD_LOG_PATH
 
     # Upload builds to synthetics
-    - echo "Uploading app-release.apk to Synthetics"
-    - ./scripts/upload.sh android/app/build/outputs/apk/release/app-release.apk ANDROID
-    - echo "Uploading BenchmarkRunner.ipa to Synthetics"
-    - ./scripts/upload.sh ios/BenchmarkRunner.ipa/BenchmarkRunner.ipa IOS
+    # TEST ONLY: upload disabled so this pipeline does not publish a new
+    # --latest version to the shared Synthetics mobile apps.
+    - echo "SKIPPING Synthetics upload (test pipeline)"
+    # - ./scripts/upload.sh android/app/build/outputs/apk/release/app-release.apk ANDROID
+    # - ./scripts/upload.sh ios/BenchmarkRunner.ipa/BenchmarkRunner.ipa IOS
 
   artifacts:
     paths:
diff --git a/benchmarks/scripts/secrets/get-secret.sh b/benchmarks/scripts/secrets/get-secret.sh
index 40417fa21..d071e03ce 100644
--- a/benchmarks/scripts/secrets/get-secret.sh
+++ b/benchmarks/scripts/secrets/get-secret.sh
@@ -9,6 +9,7 @@ get_secret() {
 
     export VAULT_ADDR=$DD_VAULT_ADDR
     if [ "$CI" = "true" ]; then
+        eval "$(aws configure export-credentials --format env)"
         vault login -method=aws -no-print
     else
         if vault token lookup &>/dev/null; then