diff --git a/Cargo.lock b/Cargo.lock
index 4e130f7f8..53d39eabf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -825,9 +825,9 @@ dependencies = [
 
 [[package]]
 name = "aws-credential-types"
-version = "1.2.8"
+version = "1.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf26925f4a5b59eb76722b63c2892b1d70d06fa053c72e4a100ec308c1d47bc"
+checksum = "8f20799b373a1be121fe3005fba0c2090af9411573878f224df44b42727fcaf7"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -992,9 +992,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.6"
+version = "1.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "127fcfad33b7dfc531141fda7e1c402ac65f88aca5511a4d31e2e3d2cd01ce9c"
+checksum = "2ffcaf626bdda484571968400c326a244598634dc75fd451325a54ad1a59acfc"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -1159,9 +1159,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.9.2"
+version = "1.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec7204f9fd94749a7c53b26da1b961b4ac36bf070ef1e0b94bb09f79d4f6c193"
+checksum = "876ab3c9c29791ba4ba02b780a3049e21ec63dabda09268b175272c3733a79e6"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-types",
@@ -1176,9 +1176,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.3.4"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25f535879a207fce0db74b679cfc3e91a3159c8144d717d55f5832aea9eef46e"
+checksum = "9d73dbfbaa8e4bc57b9045137680b958d274823509a360abfd8e1d514d40c95c"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -3113,7 +3113,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3608,7 +3608,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4282,7 +4282,7 @@ dependencies = [
  "gobject-sys",
  "libc",
  "system-deps 7.0.7",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5992,7 +5992,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi 0.5.2",
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6048,9 +6048,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
 [[package]]
 name = "jep106"
@@ -7370,7 +7370,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8990,6 +8990,8 @@ dependencies = [
 name = "orb-x-optee"
 version = "0.0.1"
 dependencies = [
+ "aws-config",
+ "aws-credential-types",
  "cargo_metadata",
  "clap",
  "cmd_lib",
@@ -8998,6 +9000,7 @@ dependencies = [
  "object 0.38.1",
  "serde",
  "serde_json",
+ "tokio",
  "uuid 1.19.0",
 ]
 
@@ -9074,7 +9077,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11047,7 +11050,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11168,7 +11171,7 @@ dependencies = [
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs 1.0.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11250,9 +11253,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "sacabase"
@@ -12747,7 +12750,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -13021,9 +13024,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.48.0"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
  "bytes",
  "libc",
@@ -13147,9 +13150,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.17"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
@@ -13500,9 +13503,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -13512,9 +13515,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -13523,9 +13526,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
  "valuable",
@@ -14280,7 +14283,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index a76f5094a..9645190e9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -89,6 +89,7 @@ async-stream = "0.3.6"
 async-tempfile = "0.7.0"
 async-trait = "0.1.88"
 aws-config = "=1.5.5"
+aws-credential-types = "1.2.14"
 aws-sdk-s3 = "=1.46.0"
 axum = "0.8.3"
 base64 = "0.22.1"
@@ -111,10 +112,6 @@ console-subscriber = "0.4"
 dashmap = "5.5.3"
 data-encoding = "2.3"
 dbus-launch = "0.2.0"
-derive_more = { version = "2.1.0", default-features = false, features = [
-	"display",
-	"from",
-] }
 ed25519-dalek = { version = "2.1.1", default-features = false, features = ["std"] }
 escargot = "0.5.15"
 eyre = "0.6.12"
@@ -147,10 +144,6 @@ pkg-config = "0.3.32"
 proptest = "1.10.0"
 rand = "0.8"
 regex = "1.11.2"
-reqwest = { version = "0.12.24", default-features = false, features = [
-	"rustls-tls",
-	"stream",
-] }
 ring = "0.17.2"
 rkyv = "0.7.46"
 rustix = "0.38.37"
@@ -229,10 +222,20 @@ seek-camera.path = "seek-camera/wrapper"
 test-utils.path = "test-utils"
 zenorb.path = "zenorb"
 
+[workspace.dependencies.derive_more]
+default-features = false
+features = ["display", "from"]
+version = "2.1.0"
+
 [workspace.dependencies.orb-messages]
 git = "https://github.com/worldcoin/orb-messages"
 rev = "af472fadb57ce55ac63f8f94bd2a0608e62405c7"
 
+[workspace.dependencies.reqwest]
+default-features = false
+features = ["rustls-tls", "stream"]
+version = "0.12.24"
+
 [patch.crates-io.optee-teec-sys]
 branch = "tfh"
 git = "https://github.com/TheButlah/teaclave-trustzone-sdk"
diff --git a/s3-helpers/src/client.rs b/s3-helpers/src/client.rs
index 4180c04a2..ae42480df 100644
--- a/s3-helpers/src/client.rs
+++ b/s3-helpers/src/client.rs
@@ -44,7 +44,7 @@ pub async fn client() -> Result<aws_sdk_s3::Client> {
     let retry_config =
         RetryConfig::standard().with_max_attempts(TIMEOUT_RETRY_ATTEMPTS);
 
-    let config = aws_config::defaults(BehaviorVersion::v2025_08_07())
+    let config = aws_config::defaults(BehaviorVersion::v2026_01_12())
         .region(region_provider)
         .credentials_provider(credentials_provider)
         .retry_config(retry_config)
diff --git a/s3-helpers/tests/common/mod.rs b/s3-helpers/tests/common/mod.rs
index a7a0c4beb..cf8b693c4 100644
--- a/s3-helpers/tests/common/mod.rs
+++ b/s3-helpers/tests/common/mod.rs
@@ -44,7 +44,7 @@ impl TestCtx {
                     .operation_timeout(Duration::from_secs(5))
                     .build(),
             )
-            .behavior_version(BehaviorVersion::v2025_08_07())
+            .behavior_version(BehaviorVersion::v2026_01_12())
             .region(Region::new("us-east-1"))
             .credentials_provider(creds)
             .endpoint_url(endpoint_url)
diff --git a/xtask/optee/Cargo.toml b/xtask/optee/Cargo.toml
index c983aedb0..0f5787952 100644
--- a/xtask/optee/Cargo.toml
+++ b/xtask/optee/Cargo.toml
@@ -13,6 +13,8 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+aws-config.workspace = true
+aws-credential-types.workspace = true
 cargo_metadata = "0.22.0"
 clap = { workspace = true, features = ["derive"] }
 cmd_lib.workspace = true
@@ -21,4 +23,5 @@ derive_more = { workspace = true, features = ["display"] }
 object = "0.38.1"
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
+tokio.workspace = true
 uuid.workspace = true
diff --git a/xtask/optee/src/lib.rs b/xtask/optee/src/lib.rs
index bd5ea5148..72b3ee858 100644
--- a/xtask/optee/src/lib.rs
+++ b/xtask/optee/src/lib.rs
@@ -5,11 +5,13 @@ use std::{
     sync::LazyLock,
 };
 
+use aws_config::default_provider::credentials::DefaultCredentialsChain;
+use aws_credential_types::provider::ProvideCredentials as _;
 use clap::ValueEnum;
 use cmd_lib::run_cmd;
 use color_eyre::{
-    eyre::{ensure, Context as _, ContextCompat, OptionExt},
-    Result,
+    eyre::{ensure, Context as _, ContextCompat, OptionExt as _},
+    Result, Section as _,
 };
 use derive_more::Display;
 use uuid::Uuid;
@@ -113,6 +115,31 @@ impl SignArgs {
             format!("failed to read requried arg: {ENV_OPTEE_OS_PATH}")
         })?;
 
+        let creds_fut = async {
+            let credentials_provider = DefaultCredentialsChain::builder().build().await;
+            credentials_provider
+            .provide_credentials()
+            .await
+            .wrap_err("failed to get aws credentials")
+            .with_note(|| {
+                format!("AWS_PROFILE env var was {:?}", std::env::var("AWS_PROFILE"))
+            })
+            .with_suggestion(|| {
+                "make sure that your aws credentials are set. Follow the instructions at
+            https://worldcoin.github.io/orb-software/aws-creds"
+            })
+            .with_suggestion(|| {
+                "try running `AWS_PROFILE=<profile> aws sso login --use-device-code` to refresh your \
+            credentials"
+            })
+        };
+        let _creds = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .enable_io()
+            .build()
+            .wrap_err("failed to make tokio runtime")?
+            .block_on(creds_fut)?;
+
         run_cmd!(uv run --all-packages $optee_os_path/scripts/sign_encrypt.py sign-enc --uuid $inspected_uuid --in $file_to_sign --out $out_dir/$inspected_uuid.ta --key $key_id)?;
 
         Ok(())