diff --git a/lib/plugins/aws/provider.js b/lib/plugins/aws/provider.js
index 2bb29e701..593f19935 100644
--- a/lib/plugins/aws/provider.js
+++ b/lib/plugins/aws/provider.js
@@ -1802,11 +1802,9 @@ class AwsProvider {
    */
   async _requestV3(service, method, params = {}, options = {}) {
     try {
-      if (!this.clientFactory) {
-        this.clientFactory = new AWSClientFactory(this._getV3BaseConfig());
-      }
+      await this._ensureV3ClientFactory();
 
-      const clientConfig = this._buildV3ClientConfig(service, method, options);
+      const clientConfig = await this._buildV3ClientConfig(service, method, options);
 
       const command = createCommand(service, method, params);
 
@@ -1823,30 +1821,28 @@ class AwsProvider {
    * @param {Object} options - Client configuration options
    * @returns {Object} AWS SDK v3 client instance
    */
-  getV3Client(service, options = {}) {
-    if (!this.clientFactory) {
-      this.clientFactory = new AWSClientFactory(this._getV3BaseConfig());
-    }
+  async getV3Client(service, options = {}) {
+    await this._ensureV3ClientFactory();
 
-    const clientConfig = this._buildV3ClientConfig(service, null, options);
+    const clientConfig = await this._buildV3ClientConfig(service, null, options);
     return this.clientFactory.getClient(service, clientConfig);
   }
 
+  async _ensureV3ClientFactory() {
+    if (this.clientFactory) {
+      return;
+    }
+
+    const baseConfig = await this._getV3BaseConfig();
+    this.clientFactory = new AWSClientFactory(baseConfig);
+  }
+
   /**
    * Build base configuration for AWS SDK v3 clients
    * @private
    */
-  _getV3BaseConfig() {
-    // Convert v2 credentials format to v3 format
-    const { credentials: v2Creds } = this.getCredentials();
-    const credentials =
-      v2Creds && v2Creds.accessKeyId
-        ? {
-            accessKeyId: v2Creds.accessKeyId,
-            secretAccessKey: v2Creds.secretAccessKey,
-            sessionToken: v2Creds.sessionToken,
-          }
-        : undefined;
+  async _getV3BaseConfig() {
+    const credentials = await this._resolveV2CredentialsForV3();
 
     return buildClientConfig({
       region: this.getRegion(),
@@ -1854,12 +1850,36 @@ class AwsProvider {
     });
   }
 
+  async _resolveV2CredentialsForV3() {
+    const { credentials: v2Creds } = this.getCredentials();
+    if (!v2Creds) {
+      return undefined;
+    }
+
+    // Hydrate lazy v2 credentials before copying
+    if (typeof v2Creds.getPromise === 'function') {
+      await v2Creds.getPromise();
+    } else if (typeof v2Creds.refreshPromise === 'function') {
+      await v2Creds.refreshPromise();
+    }
+
+    if (!v2Creds.accessKeyId || !v2Creds.secretAccessKey) {
+      return undefined;
+    }
+
+    return {
+      accessKeyId: v2Creds.accessKeyId,
+      secretAccessKey: v2Creds.secretAccessKey,
+      sessionToken: v2Creds.sessionToken,
+    };
+  }
+
   /**
    * Build client-specific configuration for AWS SDK v3
    * @private
    */
-  _buildV3ClientConfig(service, method, options) {
-    const baseConfig = this._getV3BaseConfig();
+  async _buildV3ClientConfig(service, method, options) {
+    const baseConfig = await this._getV3BaseConfig();
     const requestOptions = _.isObject(options) ? options : {};
 
     // Override region if specified