diff --git a/scripts/lib/aws.sh b/scripts/lib/aws.sh
new file mode 100644
index 0000000..8099cdf
--- /dev/null
+++ b/scripts/lib/aws.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Shared by scripts/*.sh and scripts/matches/*.sh.
+#
+# require_aws_credentials fails fast when there are no working AWS
+# credentials, rather than letting the first real aws call die with a less
+# obvious error partway through. It makes a real sts call rather than
+# checking for AWS_PROFILE or any other env var, so it also catches an
+# expired SSO session, not just a missing one.
+
+require_aws_credentials() {
+  aws sts get-caller-identity >/dev/null 2>&1 || {
+    echo "no working AWS credentials; sign in and retry" >&2
+    exit 1
+  }
+}
diff --git a/scripts/logs.sh b/scripts/logs.sh
index 928e795..e83c6ee 100755
--- a/scripts/logs.sh
+++ b/scripts/logs.sh
@@ -2,7 +2,8 @@
 # Follow a container's logs on the api host: ./scripts/logs.sh [api|caddy]
 set -euo pipefail
 
-export AWS_PROFILE="${AWS_PROFILE:-lance-blue}"
+source "$(dirname "$0")/lib/aws.sh"
+require_aws_credentials
 ENV_DIR="$(dirname "$0")/../envs/lance.blue"
 container="${1:-api}"
 
diff --git a/scripts/matches/killall.sh b/scripts/matches/killall.sh
index edf9d61..b3c0876 100755
--- a/scripts/matches/killall.sh
+++ b/scripts/matches/killall.sh
@@ -7,7 +7,8 @@
 # deliberately, and this stays an operator's big red button.
 set -euo pipefail
 
-export AWS_PROFILE="${AWS_PROFILE:-lance-blue}"
+source "$(dirname "$0")/../lib/aws.sh"
+require_aws_credentials
 ENV_DIR="$(dirname "$0")/../../envs/lance.blue"
 
 CLUSTER="$(tofu -chdir="$ENV_DIR" output -raw match_cluster_name)"
diff --git a/scripts/matches/list.sh b/scripts/matches/list.sh
index 22d63a5..64ade80 100755
--- a/scripts/matches/list.sh
+++ b/scripts/matches/list.sh
@@ -6,7 +6,8 @@
 # data it says so and the task list still prints.
 set -uo pipefail
 
-export AWS_PROFILE="${AWS_PROFILE:-lance-blue}"
+source "$(dirname "$0")/../lib/aws.sh"
+require_aws_credentials
 ENV_DIR="$(dirname "$0")/../../envs/lance.blue"
 HOURS="${1:-6}"
 
diff --git a/scripts/matches/logs.sh b/scripts/matches/logs.sh
index a757379..2dbff6f 100755
--- a/scripts/matches/logs.sh
+++ b/scripts/matches/logs.sh
@@ -7,7 +7,8 @@
 # id (short prefix is enough, see scripts/matches/list.sh) follows just that one.
 set -uo pipefail
 
-export AWS_PROFILE="${AWS_PROFILE:-lance-blue}"
+source "$(dirname "$0")/../lib/aws.sh"
+require_aws_credentials
 ENV_DIR="$(dirname "$0")/../../envs/lance.blue"
 TASK="${1:-}"
 SINCE="${2:-30m}"
diff --git a/scripts/shell.sh b/scripts/shell.sh
index 8f62872..42c1080 100755
--- a/scripts/shell.sh
+++ b/scripts/shell.sh
@@ -3,7 +3,8 @@
 # session-manager-plugin - see DEVELOPING.md. sudo works inside.
 set -euo pipefail
 
-export AWS_PROFILE="${AWS_PROFILE:-lance-blue}"
+source "$(dirname "$0")/lib/aws.sh"
+require_aws_credentials
 ENV_DIR="$(dirname "$0")/../envs/lance.blue"
 
 exec aws ssm start-session \