diff --git a/.github/workflows/publish-repos.yml b/.github/workflows/publish-repos.yml
index ef2fa14..e570bbf 100644
--- a/.github/workflows/publish-repos.yml
+++ b/.github/workflows/publish-repos.yml
@@ -60,13 +60,16 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y dpkg-dev createrepo-c python3-pip
-          # Install aws-cli v1 via pip, overriding the pre-installed v2.
-          # aws-cli v2.23+ sends CRC64NVME checksums that Cloudflare R2 rejects
-          # with Unauthorized, and the s3transfer lib used by `aws s3 sync` has
-          # a confirmed bug where WHEN_REQUIRED env var is silently ignored
-          # (boto/s3transfer#327). aws-cli v1 never sends these headers at all
-          # and matches the proven local Docker publish path.
+          # Remove pre-installed aws-cli v2 — it sends CRC64NVME checksums
+          # that Cloudflare R2 rejects with Unauthorized, and the s3transfer
+          # lib has a confirmed bug where WHEN_REQUIRED is silently ignored
+          # (boto/s3transfer#327). Install aws-cli v1 via pip instead.
+          sudo rm -f /usr/local/bin/aws /usr/local/bin/aws_completer
+          sudo rm -rf /usr/local/aws-cli
           pip3 install --break-system-packages awscli
+          # Ensure pip-installed aws is on PATH (pip may install to ~/.local/bin)
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          aws --version
 
       - name: Download packages from GitHub release
         env: