diff --git a/.builds/conformance-image-rebuild.yml b/.builds/conformance-image-rebuild.yml
index 32fcbb7e1e143f75806c234104bc1d311cc78269..6c7fef0d10c1d04133981876e3595cba3a6cfe03 100644
--- a/.builds/conformance-image-rebuild.yml
+++ b/.builds/conformance-image-rebuild.yml
@@ -47,12 +47,14 @@       EOF
       echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
       echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
       set +x
-      export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
-      export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)
+      export AWS_ACCESS_KEY_ID=$(tr -d '[:space:]' < ~/.s3-cache-key-id)
+      export AWS_SECRET_ACCESS_KEY=$(tr -d '[:space:]' < ~/.s3-cache-key-secret)
       {
         printf 'export AWS_ACCESS_KEY_ID=%q\n'     "$AWS_ACCESS_KEY_ID"
         printf 'export AWS_SECRET_ACCESS_KEY=%q\n' "$AWS_SECRET_ACCESS_KEY"
       } >> ~/.buildenv
+      echo "key_id_len=${#AWS_ACCESS_KEY_ID} key_id_prefix=${AWS_ACCESS_KEY_ID:0:2}"
+      echo "secret_len=${#AWS_SECRET_ACCESS_KEY}"
       set -x
   - docker_start: |
       sudo systemctl start docker
diff --git a/.builds/conformance.yml b/.builds/conformance.yml
index 672fd9d353e65b8c24368c484174d8f1f793be9b..9ed576a1c132336ed192135ded4f7a44fa8537ee 100644
--- a/.builds/conformance.yml
+++ b/.builds/conformance.yml
@@ -53,12 +53,19 @@       echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
       export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
       export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
       set +x
-      export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
-      export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)
+      # tr strips any trailing whitespace / CR / accidental newlines that
+      # $(cat ...) won't (it only chops trailing \n, not \r or spaces).
+      export AWS_ACCESS_KEY_ID=$(tr -d '[:space:]' < ~/.s3-cache-key-id)
+      export AWS_SECRET_ACCESS_KEY=$(tr -d '[:space:]' < ~/.s3-cache-key-secret)
       {
         printf 'export AWS_ACCESS_KEY_ID=%q\n'     "$AWS_ACCESS_KEY_ID"
         printf 'export AWS_SECRET_ACCESS_KEY=%q\n' "$AWS_SECRET_ACCESS_KEY"
       } >> ~/.buildenv
+      # Length-only diagnostics — Garage v2.2 keys are GK + 24 hex (26 chars);
+      # secret is typically 40 hex chars. If lengths look odd, the cause is
+      # either a registration swap or whitespace contamination upstream of tr.
+      echo "key_id_len=${#AWS_ACCESS_KEY_ID} key_id_prefix=${AWS_ACCESS_KEY_ID:0:2}"
+      echo "secret_len=${#AWS_SECRET_ACCESS_KEY}"
       set -x
       aws --endpoint-url="$AWS_ENDPOINT_URL" s3 ls "s3://$S3_BUCKET/" >/dev/null
   - install_go: |