diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cffdcddf2ed..cfd791338ba 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -123,7 +123,11 @@ default:
   - |
     if [[ ! $CI_COMMIT_BRANCH =~ ^(master|release/.*)$ ]]; then
       export GIT_BASE_REF=$(.gitlab/find-gh-base-ref.sh)
-      export GRADLE_PARAMS="$GRADLE_PARAMS -PgitBaseRef=origin/$GIT_BASE_REF"
+      if [[ -n "$GIT_BASE_REF" ]]; then
+        export GRADLE_PARAMS="$GRADLE_PARAMS -PgitBaseRef=origin/$GIT_BASE_REF"
+      else
+        echo "Failed to find base ref for PR" >&2
+      fi
     fi
 
 .gradle_build: &gradle_build
diff --git a/.gitlab/find-gh-base-ref.sh b/.gitlab/find-gh-base-ref.sh
index 2e20a4ea31c..e007ab796a2 100755
--- a/.gitlab/find-gh-base-ref.sh
+++ b/.gitlab/find-gh-base-ref.sh
@@ -2,9 +2,40 @@
 # Determines the base branch for the current PR (if we are running in a PR).
 set -euo pipefail
 
+CURRENT_HEAD_SHA="$(git rev-parse HEAD)"
+if [[ -z "${CURRENT_HEAD_SHA:-}" ]]; then
+  echo "Failed to determine current HEAD SHA" >&2
+  exit 1
+fi
+
+# 'workspace' is declared in the ci pipeline cache
+CACHE_PATH=workspace/find-gh-base-ref.cache
+save_cache() {
+  local base_ref="$1"
+  local head_sha="$2"
+  mkdir -p workspace
+  echo "CACHED_BASE_REF=${base_ref}" > "$CACHE_PATH"
+  echo "CACHED_HEAD_SHA=${head_sha}" >> "$CACHE_PATH"
+}
+
+# Get cached result (if HEAD commit matches)
+if [[ -f $CACHE_PATH ]]; then
+  set -a
+  source "$CACHE_PATH"
+  set +a
+  if [[ "$CURRENT_HEAD_SHA" == "${CACHED_HEAD_SHA:-}" && -n "${CACHED_BASE_REF:-}" ]]; then
+    echo "Cache hit on $CACHE_PATH" >&2
+    echo "$CACHED_BASE_REF"
+    exit 0
+  else
+    echo "Cache miss on $CACHE_PATH" >&2
+  fi
+fi
+
 # Happy path: if we're just one commit away from master, base ref is master.
 if [[ $(git log --pretty=oneline origin/master..HEAD | wc -l) -eq 1 ]]; then
   echo "We are just one commit away from master, base ref is master" >&2
+  save_cache "master" "$CURRENT_HEAD_SHA"
   echo "master"
   exit 0
 fi
@@ -17,14 +48,19 @@ if [[ -z "${CI_COMMIT_REF_NAME}" ]]; then
   exit 1
 fi
 
+# In GitLab, CI_PROJECT_NAME is set, otherwise, set it for testing.
+export CI_PROJECT_NAME="${CI_PROJECT_NAME:-dd-trace-java}"
+
 if [[ -z "${GITHUB_TOKEN:-}" ]]; then
   echo "GITHUB_TOKEN is not set, fetching from AWS SSM" >&2
   if ! command -v aws >/dev/null 2>&1; then
     echo "aws is not installed, please install it" >&2
     exit 1
   fi
+  set +e
   GITHUB_TOKEN=$(aws ssm get-parameter --name "ci.$CI_PROJECT_NAME.gh_release_token" --with-decryption --query "Parameter.Value" --output text)
-  if [[ -z "${GITHUB_TOKEN}" ]]; then
+  set -e
+  if [[ -z "${GITHUB_TOKEN:-}" ]]; then
     echo "Failed to fetch GITHUB_TOKEN from AWS SSM" >&2
     exit 1
   fi
@@ -57,9 +93,12 @@ while true; do
   if [[ ${exit_code} -eq 0 ]]; then
     PR_NUMBER=$(echo "$PR_DATA" | sed '1,/^[[:space:]]*$/d' | jq -r '.[].number')
     PR_BASE_REF=$(echo "$PR_DATA" | sed '1,/^[[:space:]]*$/d' | jq -r '.[].base.ref')
-    echo "PR is https://github.com/datadog/dd-trace-java/pull/${PR_NUMBER} and base ref is ${PR_BASE_REF}">&2
-    echo "${PR_BASE_REF}"
-    exit 0
+    if [[ -n "${PR_BASE_REF:-}" ]]; then
+      echo "PR is https://github.com/datadog/dd-trace-java/pull/${PR_NUMBER} and base ref is ${PR_BASE_REF}">&2
+      save_cache "${PR_BASE_REF}" "$CURRENT_HEAD_SHA"
+      echo "${PR_BASE_REF}"
+      exit 0
+    fi
   fi
   if echo "$PR_DATA" | grep -q "^x-ratelimit-reset:"; then
     reset_timestamp=$(echo -n "$PR_DATA" | grep "^x-ratelimit-reset:" | sed -e 's/^x-ratelimit-reset: //' -e 's/\r//')
@@ -70,7 +109,5 @@ while true; do
     continue
   fi
   echo -e "GitHub request failed for an unknown reason:\n$(echo "$PR_DATA" | sed '/^$/q')" >&2
-  echo "Assuming base ref is master" >&2
-  echo "master"
-  exit 0
+  exit 1
 done