diff --git a/.builds/conformance-image-rebuild.yml b/.builds/conformance-image-rebuild.yml
index d105cfc3079c46b72c36f2f704280c4d8f04ce5d..32fcbb7e1e143f75806c234104bc1d311cc78269 100644
--- a/.builds/conformance-image-rebuild.yml
+++ b/.builds/conformance-image-rebuild.yml
@@ -12,7 +12,7 @@ packages:
   - curl
   - ca-certificates
   - docker.io
-  - awscli
+  - unzip
   - zstd
 secrets:
   - a42011da-a362-40da-9db6-1bf1f9be8be3   # ~/.s3-cache-key-id
@@ -29,6 +29,12 @@   git.sr.ht:
     enabled: false
     allow-refs: []
 tasks:
+  - install_awscli: |
+      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+        -o /tmp/awscliv2.zip
+      unzip -q /tmp/awscliv2.zip -d /tmp
+      sudo /tmp/aws/install
+      aws --version
   - aws_credentials: |
       mkdir -p ~/.aws
       cat > ~/.aws/config <<EOF
@@ -38,6 +44,8 @@       s3 =
           addressing_style = path
           signature_version = s3v4
       EOF
+      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
+      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
       set +x
       export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
       export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)
diff --git a/.builds/conformance.yml b/.builds/conformance.yml
index 728fbc4aff80c7f8f011d36065623237950ec639..672fd9d353e65b8c24368c484174d8f1f793be9b 100644
--- a/.builds/conformance.yml
+++ b/.builds/conformance.yml
@@ -7,7 +7,7 @@   - protobuf-compiler
   - cmake
   - build-essential
   - docker.io
-  - awscli
+  - unzip
   - zstd
 secrets:
   - a42011da-a362-40da-9db6-1bf1f9be8be3   # ~/.s3-cache-key-id
@@ -30,6 +30,13 @@     allow-refs:
       - refs/heads/master
       - "refs/tags/*"
 tasks:
+  - install_awscli: |
+      # awscli was dropped from Ubuntu noble's repos; install v2 from upstream.
+      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+        -o /tmp/awscliv2.zip
+      unzip -q /tmp/awscliv2.zip -d /tmp
+      sudo /tmp/aws/install
+      aws --version
   - aws_credentials: |
       mkdir -p ~/.aws
       cat > ~/.aws/config <<EOF
@@ -39,6 +46,12 @@       s3 =
           addressing_style = path
           signature_version = s3v4
       EOF
+      # Garage doesn't implement the newer trailing CRC32 checksums that
+      # boto3 1.36+ sends by default — switch to "only when required".
+      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
+      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
+      export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
+      export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
       set +x
       export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
       export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)