diff --git a/ci.sh b/ci.sh
index 26b0dfecb105..101409c887ce 100755
--- a/ci.sh
+++ b/ci.sh
@@ -53,7 +53,11 @@ function print_usage {
 
 [ -n "$cmd" ] && shift
 
-instance_name=${INSTANCE_NAME:-$(echo -n "$BRANCH" | tr -c 'a-zA-Z0-9-' '_')_${arch}}
+# Keep this in sync with bootstrap_ec2's instance_name scheme (repo-scoped) so the
+# shell/kill/get-ip helpers find instances launched by a CI run for this repo.
+repo=${GITHUB_REPOSITORY##*/}
+repo=${repo:-aztec-packages}
+instance_name=${INSTANCE_NAME:-${repo}_$(echo -n "$BRANCH" | tr -c 'a-zA-Z0-9-' '_')_${arch}}
 [ -n "${INSTANCE_POSTFIX:-}" ] && instance_name+="_$INSTANCE_POSTFIX"
 
 function get_ip_for_instance {
diff --git a/ci3/bootstrap_ec2 b/ci3/bootstrap_ec2
index a15113a4c126..f5ce6c62868b 100755
--- a/ci3/bootstrap_ec2
+++ b/ci3/bootstrap_ec2
@@ -65,11 +65,18 @@ if [[ "$(git fetch origin --negotiate-only --negotiation-tip="$current_commit")"
 fi
 
 # Our instance_name acts as a uniqueness key for the instance.
-# Instances are terminated if they exist with the same name.
+# Instances are terminated if they exist with the same name; this reaps orphans
+# left when a GA run is cancelled (e.g. by a new push) on the same ref.
+# Scope the key to the repo: aztec-packages and aztec-packages-private can build
+# the same tag/ref concurrently under the same role, and must not reap each
+# other's instances. The key stays stable across re-runs within a repo, so the
+# orphan cleanup still works.
+repo=${GITHUB_REPOSITORY##*/}
+repo=${repo:-aztec-packages}
 if [[ "$REF_NAME" =~ ^gh-readonly-queue/.*(pr-[0-9]+) ]]; then
-  instance_name="${BASH_REMATCH[1]}_$arch"
+  instance_name="${repo}_${BASH_REMATCH[1]}_$arch"
 else
-  instance_name=$(echo -n "$REF_NAME" | head -c 50 | tr -c 'a-zA-Z0-9-' '_')_$arch
+  instance_name="${repo}_$(echo -n "$REF_NAME" | head -c 50 | tr -c 'a-zA-Z0-9-' '_')_$arch"
 fi
 
 state_dir=$(mktemp -d /tmp/aws_request_instance.XXXXXX)