From 25b137e0abd36b8a0a6a48c72ede410456a4b0bd Mon Sep 17 00:00:00 2001
From: mat <mstrommen@gmail.com>
Date: Wed, 4 Mar 2026 22:59:23 -0500
Subject: [PATCH] fix(ci): switch ha-build to static AWS key auth

---
 .github/workflows/ha-build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ha-build.yml b/.github/workflows/ha-build.yml
index f28e6ba1a..94abf15d2 100644
--- a/.github/workflows/ha-build.yml
+++ b/.github/workflows/ha-build.yml
@@ -12,7 +12,6 @@ jobs:
     runs-on: [self-hosted, k3s, linux, amd64]
 
     permissions:
-      id-token: write   # required for OIDC-based AWS auth
       contents: read
 
     steps:
@@ -22,7 +21,8 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
-          role-to-assume: ${{ secrets.AWS_ECR_ROLE_ARN }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Login to Amazon ECR