diff --git a/systemtest/cmd/moxy/main.go b/systemtest/cmd/moxy/main.go
index c1d546dbd66..908b0020064 100644
--- a/systemtest/cmd/moxy/main.go
+++ b/systemtest/cmd/moxy/main.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"sync"
 
 	"github.com/klauspost/compress/gzip"
 	"github.com/klauspost/compress/zstd"
@@ -15,6 +16,12 @@ import (
 	"go.uber.org/zap/zapcore"
 )
 
+var memPool = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
+}
+
 func main() {
 	logLevel := zap.LevelFlag(
 		"loglevel", zapcore.InfoLevel,
@@ -49,18 +56,6 @@ func handler(logger *zap.Logger, username, password string) http.Handler {
 	expectedAuth := fmt.Sprintf("%s:%s", username, password)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("X-Elastic-Product", "Elasticsearch")
-		auth := r.Header.Get("Authorization")
-		actualAuth, err := base64.StdEncoding.DecodeString(auth)
-		if err != nil || string(actualAuth) != expectedAuth {
-			logger.Error(
-				"authentication failed",
-				zap.Error(err),
-				zap.String("actual", string(actualAuth)),
-				zap.String("expected", expectedAuth),
-			)
-			w.WriteHeader(http.StatusUnauthorized)
-			return
-		}
 		switch r.URL.Path {
 		case "/":
 			// MIS doesn't use this route, but apm-server checks for cluster_uuid
@@ -81,9 +76,22 @@ func handler(logger *zap.Logger, username, password string) http.Handler {
 			},
 			"tagline": "You Know, for Search"
 			}`))
+			return
 		case "/_security/user/_has_privileges":
 			w.Write([]byte(`{"username":"admin","has_all_requested":true,"cluster":{},"index":{},"application":{"apm":{"-":{"event:write":true}}}}`))
 		case "/_bulk":
+			auth := r.Header.Get("Authorization")
+			actualAuth, err := base64.StdEncoding.DecodeString(auth)
+			if err != nil || string(actualAuth) != expectedAuth {
+				logger.Error(
+					"authentication failed",
+					zap.Error(err),
+					zap.String("actual", string(actualAuth)),
+					zap.String("expected", expectedAuth),
+				)
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
 			first := true
 			var body io.Reader
 			switch r.Header.Get("Content-Encoding") {
@@ -109,7 +117,12 @@ func handler(logger *zap.Logger, username, password string) http.Handler {
 				body = r.Body
 			}
 
-			var jsonw bytes.Buffer
+			jsonw := memPool.Get().(*bytes.Buffer)
+			defer func() {
+				jsonw.Reset()
+				memPool.Put(jsonw)
+			}()
+
 			jsonw.Write([]byte(`{"items":[`))
 			scanner := bufio.NewScanner(body)
 			for scanner.Scan() {
diff --git a/testing/benchmark/variables.tf b/testing/benchmark/variables.tf
index 43c7cb86a97..80cd0950907 100644
--- a/testing/benchmark/variables.tf
+++ b/testing/benchmark/variables.tf
@@ -136,7 +136,7 @@ variable "apmbench_bin_path" {
 }
 
 variable "worker_instance_type" {
-  default     = "c6i.large"
+  default     = "c6i.2xlarge"
   type        = string
   description = "Optional instance type to use for the worker VM"
 }