diff --git a/internal/backend/s3/s3.go b/internal/backend/s3/s3.go
index 1b7f6e3d2..6fe9e384b 100644
--- a/internal/backend/s3/s3.go
+++ b/internal/backend/s3/s3.go
@@ -52,7 +52,7 @@ func open(ctx context.Context, cfg Config, rt http.RoundTripper) (*Backend, erro
 		minio.MaxRetry = int(cfg.MaxRetries)
 	}
 
-	creds, err := getCredentials(cfg)
+	creds, err := getCredentials(cfg, rt)
 	if err != nil {
 		return nil, errors.Wrap(err, "s3.getCredentials")
 	}
@@ -97,7 +97,7 @@ func open(ctx context.Context, cfg Config, rt http.RoundTripper) (*Backend, erro
 
 // getCredentials -- runs through the various credential types and returns the first one that works.
 // additionally if the user has specified a role to assume, it will do that as well.
-func getCredentials(cfg Config) (*credentials.Credentials, error) {
+func getCredentials(cfg Config, tr http.RoundTripper) (*credentials.Credentials, error) {
 	// Chains all credential types, in the following order:
 	// 	- Static credentials provided by user
 	//	- AWS env vars (i.e. AWS_ACCESS_KEY_ID)
@@ -120,7 +120,7 @@ func getCredentials(cfg Config) (*credentials.Credentials, error) {
 		&credentials.FileMinioClient{},
 		&credentials.IAM{
 			Client: &http.Client{
-				Transport: http.DefaultTransport,
+				Transport: tr,
 			},
 		},
 	})