diff --git a/src/main/java/dev/themeinerlp/bluemap/s3/storage/S3FileSystemFactory.java b/src/main/java/dev/themeinerlp/bluemap/s3/storage/S3FileSystemFactory.java
index 9a4827c..2ce1c6d 100644
--- a/src/main/java/dev/themeinerlp/bluemap/s3/storage/S3FileSystemFactory.java
+++ b/src/main/java/dev/themeinerlp/bluemap/s3/storage/S3FileSystemFactory.java
@@ -45,8 +45,6 @@ public static S3Fs build(S3Configuration cfg) {
             final URI uri;
             String region = resolved.region() != null && !resolved.region().isBlank() ? resolved.region() : DEFAULT_AWS_REGION;
             System.setProperty(AWS_REGION_KEY, region);
-            System.setProperty("aws.accessKeyId", cfg.getAccessKeyId());
-            System.setProperty("aws.secretAccessKey", cfg.getSecretAccessKey());
             // AWS SDK for Java 2.30.0+ defaults to attaching a flexible checksum (e.g. a CRC32
             // trailer) to every PutObject and validating one on every GetObject. Many
             // third-party S3-compatible stores (Ceph RGW included) don't handle that request
@@ -64,10 +62,14 @@ public static S3Fs build(S3Configuration cfg) {
                     System.setProperty("s3.spi.force-path-style", "true");
                 }
                 PROVIDER = new S3XFileSystemProvider();
+                // Credentials go through the URI userInfo instead of the global
+                // aws.accessKeyId/aws.secretAccessKey properties - see PR #83.
                 String userInfo = buildUserInfo(cfg);
                 uri = new URI("s3x", userInfo, url.getHost(), url.getPort(), "/" + cfg.getBucketName(), null, null);
             } else {
-                // AWS S3 – the provider uses the default region/credentials chain
+                // AWS S3: no URI-embedded credentials, so these are the only way to set them.
+                System.setProperty("aws.accessKeyId", cfg.getAccessKeyId());
+                System.setProperty("aws.secretAccessKey", cfg.getSecretAccessKey());
                 PROVIDER = new S3FileSystemProvider();
 
                 uri = new URI("s3","/" + cfg.getBucketName(), null, null);