diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 53da652..74c6ebb 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -65,6 +65,11 @@ jobs:
           # AWS CLI defaults to path-style for custom endpoints, so force
           # virtual-hosted style. Harmless for endpoints that accept either.
           aws configure set default.s3.addressing_style virtual
+          # AWS CLI v2.23+ enabled default integrity protections that add
+          # `aws-chunked` request encoding, which OSS rejects with
+          # InvalidArgument. Restore the pre-2.23 behavior.
+          aws configure set default.request_checksum_calculation when_required
+          aws configure set default.response_checksum_validation when_required
 
           # Normalize PREFIX: strip both leading and trailing slashes so a
           # value of "/" or "/foo/" doesn't produce a doubled or leading slash
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index ef978d7..f67ff57 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -133,6 +133,10 @@ jobs:
           fi
           # Aliyun OSS rejects path-style requests; force virtual-hosted style.
           aws configure set default.s3.addressing_style virtual
+          # AWS CLI v2.23+ default integrity protections add `aws-chunked`
+          # encoding which OSS rejects (InvalidArgument). Restore old behavior.
+          aws configure set default.request_checksum_calculation when_required
+          aws configure set default.response_checksum_validation when_required
           PREFIX="${PREFIX#/}"; PREFIX="${PREFIX%/}"
           key="${PREFIX:+${PREFIX}/}install.sh"
           aws --endpoint-url="$ENDPOINT" s3 cp install.sh "s3://${BUCKET}/${key}" \