diff --git a/.circleci/config.yml b/.circleci/config.yml
index d2695bf8c94..8621ef668bf 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1813,7 +1813,9 @@ workflows:
           - equal: ["api",<< pipeline.trigger_source >>]
           - equal: [<< pipeline.parameters.github-event-type >>, "__not_set__"] #this is to prevent triggering this workflow as the default value is always set for main_dispatch
     jobs:
-      - initialize
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:
           name: contracts-bedrock-build
           # Build with just core + script contracts.
@@ -2087,6 +2089,14 @@ workflows:
 
   go-release-op-deployer:
     jobs:
+      - initialize:
+          filters:
+            tags:
+              only: /^op-deployer.*/
+            branches:
+              ignore: /.*/
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:
           name: build-contracts-go-release-op-deployer
           filters:
@@ -2097,6 +2107,8 @@ workflows:
           build_args: --skip test
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - go-release:
           filters:
             tags:
@@ -2112,6 +2124,14 @@ workflows:
 
   go-release-op-up:
     jobs:
+      - initialize:
+          filters:
+            tags:
+              only: /^op-up.*/
+            branches:
+              ignore: /.*/
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:
           name: build-contracts-go-release-op-up
           filters:
@@ -2122,6 +2142,8 @@ workflows:
           build_args: --skip test
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - go-release:
           filters:
             tags:
@@ -2148,6 +2170,11 @@ workflows:
               only: /^(da-server|cannon|ufm-[a-z0-9\-]*|op-[a-z0-9\-]*)\/v.*/
             branches:
               ignore: /.*/
+      - initialize:
+          requires:
+            - hold
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       # Standard (medium) cross-platform docker images go here
       - docker-build:
           matrix:
@@ -2181,7 +2208,7 @@ workflows:
           context:
             - oplabs-gcr-release
           requires:
-            - hold
+            - initialize
       # Checks for cross-platform images go here
       - check-cross-platform:
           matrix:
@@ -2228,13 +2255,14 @@ workflows:
               ignore: /.*/
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - publish-cannon-prestates:
           context:
             - circleci-repo-readonly-authenticated-github-token
             - slack
             - oplabs-network-optimism-io-bucket
           requires:
-            - hold
             - cannon-prestate
           filters:
             tags:
@@ -2276,9 +2304,14 @@ workflows:
           - equal: [true, <<pipeline.parameters.fault_proofs_dispatch>>]
           - equal: ["api",<< pipeline.trigger_source >>]
     jobs:
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - cannon-prestate:
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - cannon-stf-verify:
           context:
             - slack
@@ -2288,6 +2321,8 @@ workflows:
           context:
             - slack
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - go-tests-with-fault-proof-deps:
           name: op-e2e-cannon-tests
           notify: true
@@ -2332,10 +2367,15 @@ workflows:
         - equal: [build_four_hours, <<pipeline.schedule.name>>]
         - equal: [true, << pipeline.parameters.cannon_full_test_dispatch >>]
     jobs:
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:
           build_args: --deny-warnings --skip test
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - cannon-go-lint-and-test:
           requires:
             - contracts-bedrock-build
@@ -2353,6 +2393,9 @@ workflows:
         # Trigger on manual triggers if explicitly requested
         - equal: [true, << pipeline.parameters.docker_publish_dispatch >>]
     jobs:
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - docker-build:
           matrix:
             parameters:
@@ -2378,6 +2421,8 @@ workflows:
             - oplabs-gcr
             - slack
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - check-cross-platform:
           matrix:
             parameters:
@@ -2435,12 +2480,19 @@ workflows:
           - equal: [true, <<pipeline.parameters.acceptance_tests_dispatch>>]
           - equal: ["api",<< pipeline.trigger_source >>]
     jobs:
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:  # needed for sysgo tests
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       - cannon-prestate-quick:  # needed for sysgo tests
           context:
             - circleci-repo-readonly-authenticated-github-token
+          requires:
+            - initialize
       # IN-PROCESS (base)
       - op-acceptance-tests:
           # Acceptance Testing params
@@ -2465,6 +2517,8 @@ workflows:
           context:
             - circleci-repo-readonly-authenticated-github-token
             - discord
+          requires:
+            - initialize
       # KURTOSIS (Isthmus)
       - op-acceptance-tests:
           # Acceptance Testing params
@@ -2476,6 +2530,8 @@ workflows:
           context:
             - circleci-repo-readonly-authenticated-github-token
             - discord
+          requires:
+            - initialize
       # KURTOSIS (Interop)
       - op-acceptance-tests:
           # Acceptance Testing params
@@ -2487,6 +2543,8 @@ workflows:
           context:
             - circleci-repo-readonly-authenticated-github-token
             - discord
+          requires:
+            - initialize
       # Generate flaky test report
       - generate-flaky-report:
           name: generate-flaky-tests-report
@@ -2500,7 +2558,9 @@ workflows:
       not:
         equal: [<< pipeline.git.branch >>, "develop"]
     jobs:
-      - initialize
+      - initialize:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:  # needed for sysgo tests
           context:
             - circleci-repo-readonly-authenticated-github-token
diff --git a/Makefile b/Makefile
index 7148bbd1d9d..d228d9f92fe 100644
--- a/Makefile
+++ b/Makefile
@@ -244,7 +244,9 @@ endef
 define CI_ENV_VARS
 export OP_TESTLOG_FILE_LOGGER_OUTDIR=$$(realpath ./tmp/testlogs) && \
 export SEPOLIA_RPC_URL="https://ci-sepolia-l1-archive.optimism.io" && \
-export MAINNET_RPC_URL="https://ci-mainnet-l1-archive.optimism.io"
+export MAINNET_RPC_URL="https://ci-mainnet-l1-archive.optimism.io" && \
+export NAT_INTEROP_LOADTEST_TARGET=10 && \
+export NAT_INTEROP_LOADTEST_TIMEOUT=30s
 endef
 
 # Test timeout (can be overridden via environment)