diff --git a/.github/workflows/publish-extend-otel-layer.yml b/.github/workflows/publish-extend-otel-layer.yml
index 2634ad7..0c1a183 100644
--- a/.github/workflows/publish-extend-otel-layer.yml
+++ b/.github/workflows/publish-extend-otel-layer.yml
@@ -45,8 +45,10 @@ jobs:
       OPENTELEMETRY_JS_CONTRIB_PATH: ${{ github.workspace }}/opentelemetry-js-contrib
     steps:
       - uses: actions/checkout@v4
+      # Pinned SHA — bump when upstream cx-contrib lands a fix/feature we want.
+      # Keep in sync with CX_CONTRIB_SHA in ci-scripts/publish-sandbox.sh.
       - uses: actions/checkout@v4
-        with: { repository: coralogix/opentelemetry-js-contrib, ref: coralogix-autoinstrumentation, path: opentelemetry-js-contrib }
+        with: { repository: coralogix/opentelemetry-js-contrib, ref: 3a9691a699ddd06c3644eec70bf4b50cc4217ba3, path: opentelemetry-js-contrib }
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.gitignore b/.gitignore
index 96a65fd..92a6e0d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,8 @@ collector/VERSION
 opentelemetry-js/
 opentelemetry-js-contrib-cx/
 import-in-the-middle/
+.build-cache/
+build-sandbox/
 
 .envrc
 mise.toml
diff --git a/ci-scripts/publish-sandbox.sh b/ci-scripts/publish-sandbox.sh
index b8620f0..f2f57de 100755
--- a/ci-scripts/publish-sandbox.sh
+++ b/ci-scripts/publish-sandbox.sh
@@ -2,8 +2,11 @@
 # Publishes extend-nodejs-wrapper-and-exporter-{arch} to engservicessandbox us-east-1 as a PRIVATE layer.
 # Prereqs:
 #   - AWS_PROFILE set to engservicessandbox (or SSO-logged-in) w/ lambda:PublishLayerVersion
-#   - coralogix/opentelemetry-js-contrib cloned as sibling at ../opentelemetry-js-contrib (coralogix-autoinstrumentation branch)
 #   - Run from repo root
+#
+# The coralogix/opentelemetry-js-contrib fork is auto-cloned to .build-cache/ on first run.
+# To override the clone path (e.g. for local dev against a different checkout), set
+# OPENTELEMETRY_JS_CONTRIB_PATH before invoking this script.
 
 set -euo pipefail
 
@@ -11,12 +14,28 @@ ARCH="${1:-arm64}"
 REGION="us-east-1"
 LAYER_NAME="extend-nodejs-wrapper-and-exporter-sandbox-${ARCH}"
 
+# Pinned to a specific commit on coralogix-autoinstrumentation for reproducible builds.
+# Bump when upstream cx-contrib lands a fix/feature we want.
+CX_CONTRIB_REPO="https://github.com/coralogix/opentelemetry-js-contrib.git"
+CX_CONTRIB_SHA="3a9691a699ddd06c3644eec70bf4b50cc4217ba3"
+CX_CONTRIB_CACHE="${OPENTELEMETRY_JS_CONTRIB_PATH:-.build-cache/opentelemetry-js-contrib}"
+
 case "$ARCH" in
   amd64) AWS_ARCH="x86_64" ;;
   arm64) AWS_ARCH="arm64" ;;
   *) echo "unsupported arch: $ARCH"; exit 1 ;;
 esac
 
+echo "==> resolving cx-contrib fork at $CX_CONTRIB_SHA"
+if [ ! -d "$CX_CONTRIB_CACHE/.git" ]; then
+  mkdir -p "$(dirname "$CX_CONTRIB_CACHE")"
+  git clone --filter=blob:none "$CX_CONTRIB_REPO" "$CX_CONTRIB_CACHE"
+fi
+git -C "$CX_CONTRIB_CACHE" fetch --quiet origin "$CX_CONTRIB_SHA" 2>/dev/null || git -C "$CX_CONTRIB_CACHE" fetch --quiet origin
+git -C "$CX_CONTRIB_CACHE" checkout --quiet "$CX_CONTRIB_SHA"
+export OPENTELEMETRY_JS_CONTRIB_PATH
+OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"
+
 echo "==> building collector ($ARCH)"
 make -C collector package-extend GOARCH="$ARCH"