diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ea9b22f4..977ce15c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -330,6 +330,9 @@ jobs:
     name: Release and Copy to S3 Staging Bucket
     runs-on: ubuntu-latest
     needs: [docker_latest]
+    permissions:
+      id-token: write
+      contents: read
     if: >
       !(failure() || cancelled()) &&
       contains(github.event.head_commit.message, '[release]') &&
@@ -387,22 +390,30 @@ jobs:
         run: bash scripts/ci/prepare_staging_deploy.sh
       - name: "Clean Maven cache"
         run: bash ./scripts/ci/cleanup_cache.sh
-      - name: "Configure AWS credentials"
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - name: "Deploy core distribution to S3 Staging Bucket"
+        uses: Alfresco/alfresco-build-tools/.github/actions/s3-upload@a297ff6c5bf20c667047db658dd23f60241b270a # v18.28.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_S3_STAGING_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_S3_STAGING_SECRET_KEY }}
-          aws-region: eu-west-1
-      - name: "Deploy to S3 Staging Bucket"
-        run: |
-          aws s3 cp --acl private --recursive ./deploy_dir s3://alfresco-artefacts-staging/alfresco-content-services-community/release/${BRANCH_NAME}/${BUILD_NUMBER}
-          aws s3 cp --acl private --recursive ./deploy_dir_ags s3://alfresco-artefacts-staging/community/RM/${RELEASE_VERSION}
-          echo "Finished release and deployed to https://s3.console.aws.amazon.com/s3/buckets/alfresco-artefacts-staging/alfresco-content-services-community/release/${BRANCH_NAME}/${BUILD_NUMBER}"
+          aws-region: ${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_REGION }}
+          aws-role-arn: ${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_ROLE_ARN }}
+          source: ./deploy_dir
+          destination: s3://${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_BUCKET }}/alfresco-content-services-community/release/${{ env.BRANCH_NAME }}/${{ env.BUILD_NUMBER }}
+      - name: "Deploy AGS distribution to S3 Staging Bucket"
+        uses: Alfresco/alfresco-build-tools/.github/actions/s3-upload@a297ff6c5bf20c667047db658dd23f60241b270a # v18.28.0
+        with:
+          aws-region: ${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_REGION }}
+          aws-role-arn: ${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_ROLE_ARN }}
+          source: ./deploy_dir_ags
+          destination: s3://${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_BUCKET }}/community/RM/${{ env.RELEASE_VERSION }}
+      - name: "Print staging deploy summary"
+        run: echo "Finished release and deployed to https://s3.console.aws.amazon.com/s3/buckets/${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_BUCKET }}/alfresco-content-services-community/release/${BRANCH_NAME}/${BUILD_NUMBER}"
 
   publish:
     name: Copy to S3 Release Bucket
     runs-on: ubuntu-latest
     needs: [release]
+    permissions:
+      id-token: write
+      contents: read
     if: >
       !(failure() || cancelled()) &&
       contains(github.event.head_commit.message, '[publish]') &&
@@ -414,13 +425,19 @@ jobs:
         with:
           yml_path: .github/release-versions.yml
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2
-      - name: "Configure AWS credentials"
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - name: "Copy core distribution to S3 Release Bucket"
+        uses: Alfresco/alfresco-build-tools/.github/actions/s3-upload@a297ff6c5bf20c667047db658dd23f60241b270a # v18.28.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
-          aws-region: eu-west-1
-      - name: "Deploy to S3 Release Bucket"
-        run: |
-          bash scripts/ci/copy_to_release_bucket.sh
-          bash scripts/ci/copy_ags_to_release_bucket.sh
+          aws-region: ${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_REGION }}
+          aws-role-arn: ${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_ROLE_ARN }}
+          source: s3://${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_BUCKET }}/alfresco-content-services-community/release/${{ env.BRANCH_NAME }}/${{ env.BUILD_NUMBER }}
+          destination: s3://${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_BUCKET }}/release/community/${{ env.RELEASE_VERSION }}-build-${{ env.BUILD_NUMBER }}
+          copy-props: none
+      - name: "Copy AGS distribution to S3 Release Bucket"
+        uses: Alfresco/alfresco-build-tools/.github/actions/s3-upload@a297ff6c5bf20c667047db658dd23f60241b270a # v18.28.0
+        with:
+          aws-region: ${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_REGION }}
+          aws-role-arn: ${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_ROLE_ARN }}
+          source: s3://${{ vars.AWS_STAGING_ARTIFACT_UPLOAD_BUCKET }}/community/RM/${{ env.RELEASE_VERSION }}
+          destination: s3://${{ vars.AWS_RELEASE_ARTIFACT_UPLOAD_BUCKET }}/release/community/RM/${{ env.RELEASE_VERSION }}
+          copy-props: none
diff --git a/scripts/ci/copy_ags_to_release_bucket.sh b/scripts/ci/copy_ags_to_release_bucket.sh
deleted file mode 100755
index 3683d689d..000000000
--- a/scripts/ci/copy_ags_to_release_bucket.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-echo "=========================== Starting Copy to Release Bucket Script ==========================="
-PS4="\[\e[35m\]+ \[\e[m\]"
-set -vex
-
-#
-# Copy from S3 Release bucket to S3 eu.dl bucket
-#
-
-if [ -z "${RELEASE_VERSION}" ]; then
-  echo "Please provide a RELEASE_VERSION in the format <acs-version>-<additional-info> (e.g. 7.2.0-A2)"
-  exit 1
-fi
-
-SOURCE="s3://alfresco-artefacts-staging/community/RM/${RELEASE_VERSION}"
-DESTINATION="s3://eu.dl.alfresco.com/release/community/RM/${RELEASE_VERSION}"
-
-printf "\n%s\n%s\n" "${SOURCE}" "${DESTINATION}"
-
-aws s3 cp --acl private --recursive --copy-props none "${SOURCE}" "${DESTINATION}"
-
-set +vex
-echo "=========================== Finishing Copy to Release Bucket Script =========================="
diff --git a/scripts/ci/copy_to_release_bucket.sh b/scripts/ci/copy_to_release_bucket.sh
deleted file mode 100755
index 37aa852f2..000000000
--- a/scripts/ci/copy_to_release_bucket.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-echo "=========================== Starting Copy to Release Bucket Script ==========================="
-PS4="\[\e[35m\]+ \[\e[m\]"
-set -vex
-
-#
-# Copy from S3 Release bucket to S3 eu.dl bucket
-#
-
-if [ -z "${RELEASE_VERSION}" ]; then
-  echo "Please provide a RELEASE_VERSION in the format <acs-version>-<additional-info> (e.g. 7.2.0-A2)"
-  exit 1
-fi
-
-SOURCE="s3://alfresco-artefacts-staging/alfresco-content-services-community/release/${BRANCH_NAME}/${BUILD_NUMBER}"
-DESTINATION="s3://eu.dl.alfresco.com/release/community/${RELEASE_VERSION}-build-${BUILD_NUMBER}"
-
-printf "\n%s\n%s\n" "${SOURCE}" "${DESTINATION}"
-
-aws s3 cp --acl private --recursive --copy-props none "${SOURCE}" "${DESTINATION}"
-
-set +vex
-echo "=========================== Finishing Copy to Release Bucket Script =========================="