diff --git a/.buildkite/scripts/common/setup_job_env.sh b/.buildkite/scripts/common/setup_job_env.sh
index b39eae0f2a052..dd148e0202b60 100644
--- a/.buildkite/scripts/common/setup_job_env.sh
+++ b/.buildkite/scripts/common/setup_job_env.sh
@@ -10,6 +10,11 @@ fi
 
 source .buildkite/scripts/common/util.sh
 
+# Opt out of Docker ES usage from Cypress while the 9.5.0 ES Docker image is not
+# yet published (unified release must run first to publish it). Cypress suites
+# will fall back to ES snapshot tar.gz via kbn-es.
+export CYPRESS_ES_FROM=snapshot
+
 # Set up general-purpose tokens and credentials
 {
   BUILDKITE_TOKEN="$(vault_get buildkite-ci buildkite_token_all_jobs)"
diff --git a/x-pack/solutions/security/plugins/security_solution/scripts/run_cypress/parallel.ts b/x-pack/solutions/security/plugins/security_solution/scripts/run_cypress/parallel.ts
index 0a6b600d02087..13338a8c6b21f 100644
--- a/x-pack/solutions/security/plugins/security_solution/scripts/run_cypress/parallel.ts
+++ b/x-pack/solutions/security/plugins/security_solution/scripts/run_cypress/parallel.ts
@@ -420,9 +420,14 @@ ${JSON.stringify(
           let fleetServer: StartedFleetServer | undefined;
           let shutdownEs;
 
+          // `CYPRESS_ES_FROM` must only override the *stateful* ES provisioning path.
+          // Serverless Cypress suites require the `kibana-ci/elasticsearch-serverless`
+          // Docker image and will fail to boot when run against a stateful snapshot
+          // tar.gz (e.g. `unknown setting [xpack.security.authc.native_roles.enabled]`
+          // or `unknown setting [serverless.search.enable_replicas_for_instant_failover]`).
           const esFromEnv = process.env.CYPRESS_ES_FROM;
           const configEsFrom = config.get('esTestCluster.from');
-          const esFrom = esFromEnv || (configEsFrom === 'serverless' ? 'serverless' : 'docker');
+          const esFrom = configEsFrom === 'serverless' ? 'serverless' : esFromEnv || 'docker';
 
           try {
             shutdownEs = await pRetry(