diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fb4c9b55356..b8c1a2b7154 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,6 +62,8 @@ variables:
   GRADLE_PLUGIN_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
   BUILDER_IMAGE_REPO: "registry.ddbuild.io/images/mirror/dd-trace-java-docker-build" # images are pinned in images/mirror.lock.yaml in the ddoghq/images repo
   BUILDER_IMAGE_VERSION_PREFIX: "ci-" # use either an empty string (e.g. "") for latest images or a version followed by a hyphen (e.g. "ci-" or "123_merge-")
+  # shortcut: tag republishing is not detected; use a content hash when CI builds the image.
+  ORG_GRADLE_PROJECT_ciBuilderImage: "${BUILDER_IMAGE_REPO}:${BUILDER_IMAGE_VERSION_PREFIX}"
   TEST_COUNTS_S3_BUCKET: "dd-trace-java-ci-test-reports"
   REPO_NOTIFICATION_CHANNEL: "#apm-java-escalations"
   DEFAULT_TEST_JVMS: /^(8|11|17|21|25|tip)$/ # the latest "tip" version is 27
diff --git a/dd-java-agent/agent-ci-visibility/build.gradle b/dd-java-agent/agent-ci-visibility/build.gradle
index 375df7c0315..2327b8d601c 100644
--- a/dd-java-agent/agent-ci-visibility/build.gradle
+++ b/dd-java-agent/agent-ci-visibility/build.gradle
@@ -3,6 +3,8 @@ import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
 
 plugins {
+  // ShellCommandExecutorTest invokes the image's echo, cat and sleep commands.
+  id 'dd-trace-java.ci-builder-inputs'
   id 'com.gradleup.shadow'
   id 'org.jetbrains.kotlin.jvm'
   id 'dd-trace-java.version-file'
diff --git a/dd-java-agent/agent-profiling/profiling-controller-ddprof/build.gradle b/dd-java-agent/agent-profiling/profiling-controller-ddprof/build.gradle
index 1b31128050a..354dfc5d348 100644
--- a/dd-java-agent/agent-profiling/profiling-controller-ddprof/build.gradle
+++ b/dd-java-agent/agent-profiling/profiling-controller-ddprof/build.gradle
@@ -1,4 +1,6 @@
 plugins {
+  // Tests load the native profiler selected for the image's libc variant.
+  id 'dd-trace-java.ci-builder-inputs'
   id 'dd-trace-java.module.internal-library'
 }
 
diff --git a/dd-java-agent/cws-tls/build.gradle b/dd-java-agent/cws-tls/build.gradle
index 3b20009adaf..c7b7357ed8f 100644
--- a/dd-java-agent/cws-tls/build.gradle
+++ b/dd-java-agent/cws-tls/build.gradle
@@ -2,6 +2,8 @@ import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
 import org.apache.maven.model.License
 
 plugins {
+  // CWS tests exercise JNA native memory and the image's native runtime.
+  id 'dd-trace-java.ci-builder-inputs'
   id 'com.gradleup.shadow'
   id 'dd-trace-java.version-file'
   id 'dd-trace-java.module.product-subsystem'
diff --git a/dd-smoke-tests/quarkus-native/build.gradle b/dd-smoke-tests/quarkus-native/build.gradle
index dc2c747fd46..f139cd30d1d 100644
--- a/dd-smoke-tests/quarkus-native/build.gradle
+++ b/dd-smoke-tests/quarkus-native/build.gradle
@@ -2,6 +2,8 @@ import java.util.concurrent.Callable
 import java.util.regex.Pattern
 
 plugins {
+  // Native smoke builds use GraalVM and native tools from the builder environment.
+  id 'dd-trace-java.ci-builder-inputs'
   id 'dd-trace-java.smoke-test-app'
   id 'dd-trace-java.module.smoke-test'
 }
@@ -46,6 +48,7 @@ smokeTestApp {
     environment.put('GRAALVM_HOME', graalvmHome)
     inputs {
       property('graalvmRelease', fileContent(graalvmHome, 'release'))
+      property('ciBuilderIdentity', ciBuilderInputs.identity)
     }
   }
   projectJar('apiJar', project(':dd-trace-api'))
diff --git a/dd-smoke-tests/spring-boot-3.0-native/build.gradle b/dd-smoke-tests/spring-boot-3.0-native/build.gradle
index 2424d22e6ad..7ad10fc9e99 100644
--- a/dd-smoke-tests/spring-boot-3.0-native/build.gradle
+++ b/dd-smoke-tests/spring-boot-3.0-native/build.gradle
@@ -2,6 +2,8 @@ import java.util.concurrent.Callable
 import java.util.regex.Pattern
 
 plugins {
+  // Native smoke builds use GraalVM and native tools from the builder environment.
+  id 'dd-trace-java.ci-builder-inputs'
   id 'dd-trace-java.smoke-test-app'
   id 'dd-trace-java.module.smoke-test'
 }
@@ -44,6 +46,7 @@ smokeTestApp {
     environment.put('NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION', 'true')
     inputs {
       property('graalvmRelease', fileContent(graalvmHome, 'release'))
+      property('ciBuilderIdentity', ciBuilderInputs.identity)
     }
   }
   projectJar('apiJar', project(':dd-trace-api'))
diff --git a/utils/container-utils/build.gradle.kts b/utils/container-utils/build.gradle.kts
index f4b3ff6e862..60c3eb25603 100644
--- a/utils/container-utils/build.gradle.kts
+++ b/utils/container-utils/build.gradle.kts
@@ -1,4 +1,6 @@
 plugins {
+  // ContainerInfoTest invokes the image's ls -id command.
+  id("dd-trace-java.ci-builder-inputs")
   `java-library`
   id("dd-trace-java.module.internal-library")
 }
diff --git a/utils/test-utils/build.gradle.kts b/utils/test-utils/build.gradle.kts
index bb2a07b6da7..32bc00c7a1b 100644
--- a/utils/test-utils/build.gradle.kts
+++ b/utils/test-utils/build.gradle.kts
@@ -1,4 +1,6 @@
 plugins {
+  // PortableCommandTest invokes the image's echo, cat, sleep and tail commands.
+  id("dd-trace-java.ci-builder-inputs")
   `java-library`
   id("dd-trace-java.module.internal-library")
 }