diff --git a/bench/install/run.sh b/bench/install/run.sh
index 58b0ac02..1d87a6dc 100755
--- a/bench/install/run.sh
+++ b/bench/install/run.sh
@@ -65,10 +65,39 @@ helm install tracecore "$HELM_CHART" \
 
 T_HELM=$(now_epoch_float)
 
+# Shared diagnostic dump: capture tracecore pod state + rendered config
+# + sink state, used by both the rollout-status failure path here and
+# the post-rollout first-data-deadline path below. Centralises the
+# spelunking commands so every CI red surface lands with enough context
+# to root-cause without a re-run.
+dump_failure_diagnostics() {
+  echo "==> FAIL diagnostics: tracecore pod state"
+  kubectl -n tracecore-system get pods -o wide 2>&1 || true
+  echo ""
+  TC_POD=$(kubectl -n tracecore-system get pod -l app.kubernetes.io/instance=tracecore -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
+  if [ -n "$TC_POD" ]; then
+    echo "==> FAIL diagnostics: kubectl describe pod $TC_POD"
+    kubectl -n tracecore-system describe pod "$TC_POD" 2>&1 | tail -60 || true
+    echo ""
+    echo "==> FAIL diagnostics: tracecore pod logs (last 100 lines)"
+    kubectl -n tracecore-system logs --tail=100 "$TC_POD" 2>&1 || true
+    echo ""
+    echo "==> FAIL diagnostics: tracecore previous-container logs (last 100 lines)"
+    kubectl -n tracecore-system logs --tail=100 --previous "$TC_POD" 2>&1 || true
+    echo ""
+    echo "==> FAIL diagnostics: tracecore rendered config"
+    kubectl -n tracecore-system get configmap -o yaml 2>&1 | grep -A 60 "config.yaml" | head -80 || true
+  fi
+}
+
 DS=$(kubectl -n tracecore-system get daemonset \
        -l app.kubernetes.io/instance=tracecore \
        -o jsonpath='{.items[0].metadata.name}')
-kubectl -n tracecore-system rollout status "daemonset/$DS" --timeout=5m
+if ! kubectl -n tracecore-system rollout status "daemonset/$DS" --timeout=5m; then
+  echo "==> FAIL: daemonset/$DS rollout did not complete within 5m" >&2
+  dump_failure_diagnostics
+  exit 1
+fi
 
 T_READY=$(now_epoch_float)
 
@@ -106,14 +135,7 @@ size=$([ "$ready" -eq 1 ] && echo 1 || echo 0)
 if [ "$ready" -ne 1 ]; then
   # Diagnostic dump on FAIL: capture cluster state so a CI green/red
   # signal carries enough context to root-cause without re-running.
-  echo "==> FAIL diagnostics: tracecore pod logs (last 100 lines)"
-  TC_POD=$(kubectl -n tracecore-system get pod -l app.kubernetes.io/instance=tracecore -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
-  if [ -n "$TC_POD" ]; then
-    kubectl -n tracecore-system logs --tail=100 "$TC_POD" 2>&1 || true
-    echo ""
-    echo "==> FAIL diagnostics: tracecore rendered config"
-    kubectl -n tracecore-system get configmap -o yaml 2>&1 | grep -A 60 "config.yaml" | head -80 || true
-  fi
+  dump_failure_diagnostics
   echo ""
   echo "==> FAIL diagnostics: sink pod logs (last 50 lines)"
   if [ -n "$SINK_POD" ]; then
diff --git a/install/kubernetes/tracecore/Dockerfile b/install/kubernetes/tracecore/Dockerfile
index 999ecabb..c6722d74 100644
--- a/install/kubernetes/tracecore/Dockerfile
+++ b/install/kubernetes/tracecore/Dockerfile
@@ -3,6 +3,13 @@
 # `tracecore:<tag>` builds. This file lives under the chart so the
 # install workflow can build a self-contained image without depending
 # on M3 having landed.
+#
+# RFC-0013 PR-E follow-up (2026-05-31): builds the OCB-generated binary
+# at ./_build/tracecore (via builder-config.yaml) rather than
+# ./cmd/tracecore, because the bench enables `hostmetrics` —
+# an upstream OTel-contrib receiver bundled by OCB but absent from
+# the in-tree components.go. PR-A2 makes _build/tracecore canonical
+# for all builds; this is the tactical bridge until then.
 
 # Image digests pinned for supply-chain integrity. Update by
 # `crane digest <ref>` (or `docker buildx imagetools inspect <ref>`)
@@ -10,12 +17,21 @@
 FROM golang:1.26.3-alpine@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS build
 WORKDIR /src
 COPY . .
-RUN apk add --no-cache git ca-certificates && \
+# `make build-ocb` runs `go run go.opentelemetry.io/collector/cmd/builder`
+# against builder-config.yaml, which generates main.go + go.mod under
+# ./_build/ (a self-contained module) and compiles it. We then rebuild
+# from inside ./_build with our distroless-friendly flags
+# (CGO_ENABLED=0, -trimpath, -s -w) — OCB's intermediate compile uses
+# its own defaults, so this re-link guarantees a fully static binary
+# the distroless/static base can exec.
+RUN apk add --no-cache git ca-certificates make && \
+    make build-ocb && \
+    cd _build && \
     CGO_ENABLED=0 GOOS=linux go build \
       -trimpath \
       -ldflags "-s -w" \
       -o /out/tracecore \
-      ./cmd/tracecore
+      .
 
 FROM gcr.io/distroless/static-debian12:nonroot@sha256:a9329520abc449e3b14d5bc3a6ffae065bdde0f02667fa10880c49b35c109fd1
 COPY --from=build /out/tracecore /usr/local/bin/tracecore