diff --git a/Cargo.lock b/Cargo.lock
index 3481cafc15..43c859eb68 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -397,8 +397,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 [[package]]
 name = "aws-creds"
 version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3b85155d265df828f84e53886ed9e427aed979dd8a39f5b8b2162c77e142d7"
+source = "git+https://github.com/tlongwell-block/rust-s3?rev=c9fce3620dd434c1f810101d672cf384268dbb0f#c9fce3620dd434c1f810101d672cf384268dbb0f"
 dependencies = [
  "attohttpc",
  "home",
diff --git a/Cargo.toml b/Cargo.toml
index e4c979da32..1ce18b5112 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -148,3 +148,12 @@ lto = "fat"
 codegen-units = 1
 panic = "abort"
 strip = true
+
+# Temporary fork pin: aws-creds 0.39.1 (via rust-s3) cannot read EKS Pod Identity
+# credentials (AWS_CONTAINER_CREDENTIALS_FULL_URI + AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE),
+# which the relay pod on bb-block requires for S3 media + git storage. This pins
+# aws-creds to a fork that adopts the aws-creds portion of durch/rust-s3#449
+# (FULL_URI + token-file + Authorization header, refresh-safe, with a loopback
+# allowlist for the auth token). Revert to crates.io once #449 lands upstream.
+[patch.crates-io]
+aws-creds = { git = "https://github.com/tlongwell-block/rust-s3", rev = "c9fce3620dd434c1f810101d672cf384268dbb0f" }