diff --git a/scripts/deploy.sh b/scripts/deploy.sh
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -20,6 +20,14 @@
 
 : "${AWS_PROFILE:?set AWS_PROFILE; default credentials are almost never the right account}"
 
+# The variable being set says nothing about the session behind it. Ask STS
+# now, so an expired login fails here instead of after both builds, when the
+# api push is the first thing to touch AWS.
+if ! aws sts get-caller-identity --query Account --output text >/dev/null; then
+  echo "deploy: no working AWS session for profile $AWS_PROFILE; log in again" >&2
+  exit 1
+fi
+
 command -v jq >/dev/null || {
   echo "deploy: jq is not installed; it writes releases.auto.tfvars.json" >&2
   exit 1