diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py
index 6f4fc3446361..75e17221fbe5 100644
--- a/hermes_cli/auth.py
+++ b/hermes_cli/auth.py
@@ -452,7 +452,16 @@ class ProviderConfig:
         name="AWS Bedrock",
         auth_type="aws_sdk",
         inference_base_url="https://bedrock-runtime.us-east-1.amazonaws.com",
-        api_key_env_vars=(),
+        api_key_env_vars=(
+            "AWS_ACCESS_KEY_ID",
+            "AWS_SECRET_ACCESS_KEY",
+            "AWS_SESSION_TOKEN",
+            "AWS_BEARER_TOKEN_BEDROCK",
+            "AWS_PROFILE",
+            "AWS_DEFAULT_REGION",
+            "AWS_ROLE_ARN",
+            "AWS_WEB_IDENTITY_TOKEN_FILE",
+        ),
         base_url_env_var="BEDROCK_BASE_URL",
     ),
     "azure-foundry": ProviderConfig(
diff --git a/scripts/release.py b/scripts/release.py
index 1324969ce0c4..6ea7c2818451 100755
--- a/scripts/release.py
+++ b/scripts/release.py
@@ -505,6 +505,7 @@
     "xiahu889889@proton.me": "xiahu88988",
     "nocoo@users.noreply.github.com": "nocoo",
     "30841158+n-WN@users.noreply.github.com": "n-WN",
+    "hiddenpuppy@users.noreply.github.com": "HiddenPuppy",
     "tsuijinglei@gmail.com": "hiddenpuppy",
     "buraysandro9@gmail.com": "ygd58",
     "jerome@clawwork.ai": "HiddenPuppy",
diff --git a/tests/agent/test_bedrock_integration.py b/tests/agent/test_bedrock_integration.py
index a5ab3563381f..d91a493f6759 100644
--- a/tests/agent/test_bedrock_integration.py
+++ b/tests/agent/test_bedrock_integration.py
@@ -27,11 +27,17 @@ def test_bedrock_auth_type_is_aws_sdk(self):
         pconfig = PROVIDER_REGISTRY["bedrock"]
         assert pconfig.auth_type == "aws_sdk"
 
-    def test_bedrock_has_no_api_key_env_vars(self):
-        """Bedrock uses the AWS SDK credential chain, not API keys."""
+    def test_bedrock_has_aws_sdk_env_vars_in_api_key_env_vars(self):
+        """Bedrock registers AWS SDK env vars in api_key_env_vars for subprocess blocklisting."""
         from hermes_cli.auth import PROVIDER_REGISTRY
         pconfig = PROVIDER_REGISTRY["bedrock"]
-        assert pconfig.api_key_env_vars == ()
+        aws_vars = pconfig.api_key_env_vars
+        assert "AWS_ACCESS_KEY_ID" in aws_vars
+        assert "AWS_SECRET_ACCESS_KEY" in aws_vars
+        assert "AWS_SESSION_TOKEN" in aws_vars
+        assert "AWS_BEARER_TOKEN_BEDROCK" in aws_vars
+        assert "AWS_PROFILE" in aws_vars
+        assert "AWS_DEFAULT_REGION" in aws_vars
 
     def test_bedrock_base_url_env_var(self):
         from hermes_cli.auth import PROVIDER_REGISTRY