Publishing build uploaded to iTunes Connect before provisioning profile change
We ended up submitting the build to Apple for approval and they approved it, so apparently the provisioning profile on the build waiting for review was still valid.