diff --git a/apps/gateway/src/lib/provider.ts b/apps/gateway/src/lib/provider.ts
index 342e47917..e0ad72605 100644
--- a/apps/gateway/src/lib/provider.ts
+++ b/apps/gateway/src/lib/provider.ts
@@ -97,8 +97,13 @@ export function createProvider(slug: ProviderSlug, config: unknown): ProviderV3
         case "access-key": {
           const { accessKeyId, secretAccessKey } = bedrockConfig;
           if (!accessKeyId || !secretAccessKey) return;
+          // credentialProvider: passing keys alone still merges AWS_SESSION_TOKEN from
+          // the process env (IRSA, etc.); see https://github.com/vercel/ai/issues/14136
           return withCanonicalIdsForBedrock(
-            createAmazonBedrock({ region, accessKeyId, secretAccessKey }),
+            createAmazonBedrock({
+              region,
+              credentialProvider: () => Promise.resolve({ accessKeyId, secretAccessKey }),
+            }),
           );
         }
         case "iam-role": {