diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index c128c89..5f6b363 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -63,13 +63,22 @@ env_dir="envs/$env_name"
   exit 2
 }
 
-for tool in tofu jq curl; do
+for tool in tofu aws jq curl; do
   command -v "$tool" >/dev/null || {
     echo "$tool is not installed." >&2
     exit 1
   }
 done
 
+: "${AWS_PROFILE:?set AWS_PROFILE; default credentials are almost never the right account}"
+
+# The variable being set says nothing about the session behind it. Ask STS
+# now, so an expired login fails here instead of partway into the plan.
+if ! aws sts get-caller-identity --query Account --output text >/dev/null; then
+  echo "deploy: no working AWS session for profile $AWS_PROFILE; log in again" >&2
+  exit 1
+fi
+
 # Resolved here rather than after the apply: finding out the credential is
 # missing once the deploy is already live helps nobody.
 #