diff --git a/.buildkite/pipeline.graphql.yml b/.buildkite/pipeline.graphql.yml
index d20355fff8..941078e6d3 100644
--- a/.buildkite/pipeline.graphql.yml
+++ b/.buildkite/pipeline.graphql.yml
@@ -1,3 +1,10 @@
 steps:
   - label: Update GraphQL docs
     command: .buildkite/update_graphql_docs
+    plugins:
+      - aws-assume-role-with-web-identity#v1.0.0:
+          role-arn: arn:aws:iam::445615400570:role/pipeline-buildkite-docs-private
+      - aws-ssm#v1.0.0:
+          parameters:
+            GH_TOKEN: /pipelines/buildkite/docs-private/gh-token
+            API_ACCESS_TOKEN: /pipelines/buildkite/docs-private/api-access-token
diff --git a/.buildkite/pipeline.preview.yml b/.buildkite/pipeline.preview.yml
index 5928773b98..98af9979de 100644
--- a/.buildkite/pipeline.preview.yml
+++ b/.buildkite/pipeline.preview.yml
@@ -12,6 +12,14 @@ steps:
     env:
       RAILS_ENV: "production"
     plugins:
+      - aws-assume-role-with-web-identity#v1.0.0:
+          role-arn: arn:aws:iam::445615400570:role/pipeline-buildkite-docs-private
+      - aws-ssm#v1.0.0:
+          parameters:
+            GH_TOKEN: /pipelines/buildkite/docs-private/gh-token
+            BUILDKITE_ANALYTICS_TOKEN: /pipelines/buildkite/docs-private/buildkite-analytics-token
+            NETLIFY_AUTH_TOKEN: /pipelines/buildkite/docs-private/netlify-auth-token
+            NETLIFY_SITE_ID: /pipelines/buildkite/docs-private/netlify-site-id
       - docker-compose#v3.9.0:
           run: app
           dependencies: false
diff --git a/.buildkite/pipeline.sync.yml b/.buildkite/pipeline.sync.yml
index 95081b7fa1..6d334200c6 100644
--- a/.buildkite/pipeline.sync.yml
+++ b/.buildkite/pipeline.sync.yml
@@ -1,3 +1,4 @@
+#docs-private-to-public-sync
 notify:
   - slack: "$SLACK_CHANNEL"
     if: build.state != "passed"
diff --git a/.buildkite/pipeline.sync_public_pr.yml b/.buildkite/pipeline.sync_public_pr.yml
index 5b2fe4976d..63e65fd330 100644
--- a/.buildkite/pipeline.sync_public_pr.yml
+++ b/.buildkite/pipeline.sync_public_pr.yml
@@ -11,6 +11,11 @@ steps:
   - label: ":git: Sync Public PR to Private Repo"
     command: "bin/sync-public-pr"
     plugins:
+      - aws-assume-role-with-web-identity#v1.0.0:
+          role-arn: arn:aws:iam::445615400570:role/pipeline-buildkite-docs-private
+      - aws-ssm#v1.0.0:
+          parameters:
+            GH_TOKEN: /pipelines/buildkite/docs-private/gh-token
       - docker#v5.11.0:
           image: "ruby:3.3-bookworm"
           propagate-environment: true