diff --git a/.github/chainguard/self.update-apm-sdks-benchmarks-reference.create-pr.sts.yaml b/.github/chainguard/self.update-apm-sdks-benchmarks-reference.create-pr.sts.yaml
new file mode 100644
index 00000000000..8497a76494d
--- /dev/null
+++ b/.github/chainguard/self.update-apm-sdks-benchmarks-reference.create-pr.sts.yaml
@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:ref:refs/heads/master
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-apm-sdks-benchmarks-reference\.yaml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write
diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 5ea4817ac5d..8ecd238609d 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -163,6 +163,14 @@ _Action:_ Create a PR updating the Grade dependencies and their locking files.
 
 _Recovery:_ Manually trigger the action again.
 
+### update-apm-sdks-benchmarks-reference [🔗](update-apm-sdks-benchmarks-reference.yaml)
+
+_Trigger:_ Every week or manually.
+
+_Action:_ Create a PR pinning our `apm-sdks-benchmarks` CI includes and runtime clones to the latest commit on the `apm-sdks-benchmarks` GitHub `main` branch.
+
+_Recovery:_ Manually trigger the action again.
+
 ### update-smoke-test-latest-versions [🔗](update-smoke-test-latest-versions.yaml)
 
 _Trigger:_ Every week or manually.
diff --git a/.github/workflows/update-apm-sdks-benchmarks-reference.yaml b/.github/workflows/update-apm-sdks-benchmarks-reference.yaml
new file mode 100644
index 00000000000..c33a7fa3c0f
--- /dev/null
+++ b/.github/workflows/update-apm-sdks-benchmarks-reference.yaml
@@ -0,0 +1,110 @@
+name: Update apm-sdks-benchmarks reference
+
+on:
+  schedule:
+    - cron: "0 4 * * 0"
+  workflow_dispatch:
+
+jobs:
+  update-apm-sdks-benchmarks-reference:
+    runs-on: ubuntu-latest
+    name: Update APM SDK benchmarks reference
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC token federation
+    steps:
+      - name: Get token for apm-sdks-benchmarks
+        id: benchmarks-token
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        with:
+          scope: DataDog/apm-sdks-benchmarks
+          policy: dd-trace-java.update-apm-sdks-benchmarks-reference.read
+
+      - name: Get token for dd-trace-java
+        id: dd-trace-java-token
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        with:
+          scope: DataDog/dd-trace-java
+          policy: self.update-apm-sdks-benchmarks-reference.create-pr
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1
+
+      - name: Resolve latest apm-sdks-benchmarks main commit
+        id: latest
+        env:
+          GH_TOKEN: ${{ steps.benchmarks-token.outputs.token }}
+        run: |
+          SHA=$(gh api repos/DataDog/apm-sdks-benchmarks/commits/main --jq .sha)
+          if [[ ! "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Could not resolve a full commit SHA for apm-sdks-benchmarks main." >&2
+            exit 1
+          fi
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+
+      - name: Update pinned references
+        run: |
+          ./tooling/update_apm_sdks_benchmarks_reference.sh "${{ steps.latest.outputs.sha }}"
+
+      - name: Check for changes
+        id: check-changes
+        run: |
+          if git diff --quiet -- .gitlab-ci.yml; then
+            echo "The apm-sdks-benchmarks references are already up to date."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            git diff -- .gitlab-ci.yml
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Define branch name
+        if: steps.check-changes.outputs.has_changes == 'true'
+        id: define-branch
+        run: |
+          echo "branch=ci/update-apm-sdks-benchmarks-reference-$(date +'%Y%m%d')" >> "$GITHUB_OUTPUT"
+
+      - name: Create commit
+        if: steps.check-changes.outputs.has_changes == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .gitlab-ci.yml
+          git commit -m "chore: Update APM SDK benchmarks reference"
+
+      - name: Push changes
+        if: steps.check-changes.outputs.has_changes == 'true'
+        uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1
+        with:
+          token: "${{ steps.dd-trace-java-token.outputs.token }}"
+          branch: "${{ steps.define-branch.outputs.branch }}"
+          head-sha: "${{ github.sha }}"
+          create-branch: true
+          command: push
+
+      - name: Create pull request
+        if: steps.check-changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ steps.dd-trace-java-token.outputs.token }}
+        run: |
+          gh pr create --title "Update APM SDK benchmarks reference" \
+            --base master \
+            --head "${{ steps.define-branch.outputs.branch }}" \
+            --label "comp: testing" \
+            --label "type: feature" \
+            --label "tag: dependencies" \
+            --label "tag: no release notes" \
+            --body "$(cat <<EOF
+          # What Does This Do
+
+          This PR updates the pinned apm-sdks-benchmarks GitLab CI includes and runtime clones to
+          [DataDog/apm-sdks-benchmarks@${{ steps.latest.outputs.sha }}](https://github.com/DataDog/apm-sdks-benchmarks/commit/${{ steps.latest.outputs.sha }}).
+
+          # Motivation
+
+          Keep Java SDK benchmarks current while retaining reproducible CI configuration.
+
+          # Contributor Checklist
+
+          - [ ] Verify CI passes successfully
+          EOF
+          )"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a4d81f37757..9caf7505e93 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -5,19 +5,19 @@ include:
   - local: ".gitlab/ci-visibility-tests.yml"
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-spring-petclinic-parallel.yml'
-    ref: 'main'
+    ref: &apm_sdks_benchmarks_sha 'f59ec6a23d07cb63650a2c8c694a45e479ab0dc2' # pinned by "Update apm-sdks-benchmarks reference" workflow
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-load-parallel.yml'
-    ref: 'main'
+    ref: *apm_sdks_benchmarks_sha
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-startup-parallel.yml'
-    ref: 'main'
+    ref: *apm_sdks_benchmarks_sha
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-dacapo-parallel.yml'
-    ref: 'main'
+    ref: *apm_sdks_benchmarks_sha
   - project: 'DataDog/apm-reliability/apm-sdks-benchmarks'
     file: '.gitlab/ci-java-post-pr-comment.yml'
-    ref: 'main'
+    ref: *apm_sdks_benchmarks_sha
   - local: ".gitlab/java-benchmark-configs.yml"
 
 stages:
@@ -45,6 +45,7 @@ stages:
   - generate-signing-key
 
 variables:
+  APM_SDKS_BENCHMARKS_SHA: *apm_sdks_benchmarks_sha
   # Gitlab runner features; see https://docs.gitlab.com/runner/configuration/feature-flags.html
   # Fold and time all script sections
   FF_SCRIPT_SECTIONS: 1
diff --git a/tooling/update_apm_sdks_benchmarks_reference.sh b/tooling/update_apm_sdks_benchmarks_reference.sh
new file mode 100755
index 00000000000..4f04d38ac5f
--- /dev/null
+++ b/tooling/update_apm_sdks_benchmarks_reference.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# This script updates the shared SHA used by the apm-sdks-benchmarks includes
+# and runtime clone in GitLab CI.
+# Usage: tooling/update_apm_sdks_benchmarks_reference.sh <commit-sha>
+
+if [[ $# -ne 1 || ! "$1" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "Usage: $0 <40-character commit SHA>" >&2
+    exit 1
+fi
+
+REF="$1"
+GITLAB_TARGET=".gitlab-ci.yml"
+PROJECT="DataDog/apm-reliability/apm-sdks-benchmarks"
+REFERENCE_PATTERN="(  - project: '$PROJECT'\n    file: '[^']+'\n    ref: &apm_sdks_benchmarks_sha ')(?:main|[0-9a-f]{40})(')"
+SHA_PATTERN='  APM_SDKS_BENCHMARKS_SHA: \*apm_sdks_benchmarks_sha'
+
+if [[ ! -f "$GITLAB_TARGET" ]]; then
+    echo "Error: Target file $GITLAB_TARGET does not exist" >&2
+    exit 1
+fi
+
+REFERENCE_COUNT=$(REFERENCE_PATTERN="$REFERENCE_PATTERN" perl -0ne '
+    $count++ while /$ENV{REFERENCE_PATTERN}/g;
+    END { print $count // 0 }
+' "$GITLAB_TARGET")
+SHA_COUNT=$(SHA_PATTERN="$SHA_PATTERN" perl -0ne '
+    $count++ while /$ENV{SHA_PATTERN}/g;
+    END { print $count // 0 }
+' "$GITLAB_TARGET")
+
+if [[ "$REFERENCE_COUNT" -ne 1 ]]; then
+    echo "Error: Expected one anchored $PROJECT reference, found $REFERENCE_COUNT" >&2
+    exit 1
+fi
+if [[ "$SHA_COUNT" -ne 1 ]]; then
+    echo "Error: Expected APM_SDKS_BENCHMARKS_SHA to use the shared anchor" >&2
+    exit 1
+fi
+
+REFERENCE_PATTERN="$REFERENCE_PATTERN" REF="$REF" perl -0pi -e '
+    s/$ENV{REFERENCE_PATTERN}/${1}$ENV{REF}${2}/g
+' "$GITLAB_TARGET"
+echo "Updated the shared apm-sdks-benchmarks SHA to $REF"