diff --git a/changelog/bundle-upload/action.yml b/changelog/bundle-upload/action.yml
index 9abca928..f94748cb 100644
--- a/changelog/bundle-upload/action.yml
+++ b/changelog/bundle-upload/action.yml
@@ -33,17 +33,6 @@ inputs:
   aws-account-id:
     description: 'The AWS account ID. Only override if OIDC trust and IAM roles have been provisioned for the target account.'
     default: '197730964718'
-  aws-role-arn:
-    description: >
-      Optional explicit IAM role ARN to assume for S3 access. When set, the
-      role is assumed directly via aws-actions/configure-aws-credentials and
-      the aws/auth repo-derived role derivation is skipped. Use this when the
-      caller's repo identity should not drive role selection — for example, a
-      docs-owned promotion workflow in a private repo that holds a single
-      dedicated role scoped to the bundle/* S3 prefix. Must be empty or a
-      valid ARN (arn:aws:iam::…:role/…).
-    required: false
-    default: ''
 
 runs:
   using: composite
@@ -98,15 +87,7 @@ runs:
         version: ${{ inputs.docs-builder-version }}
         github-token: ${{ inputs.github-token }}
 
-    - name: Authenticate with AWS (explicit role)
-      if: ${{ inputs.aws-role-arn != '' }}
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-      with:
-        aws-region: us-east-1
-        role-to-assume: ${{ inputs.aws-role-arn }}
-
-    - name: Authenticate with AWS (repo-derived role)
-      if: ${{ inputs.aws-role-arn == '' }}
+    - name: Authenticate with AWS
       uses: elastic/docs-actions/aws/auth@v1
       with:
         aws_account_id: ${{ inputs.aws-account-id }}