diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c207e7ea11..cf4b9e9dca0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,6 +93,9 @@ jobs:
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
         if: success() && !env.SKIP_JOB
+      - name: install awscli
+        run: src/ci/scripts/install-awscli.sh
+        if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
         if: success() && !env.SKIP_JOB
@@ -458,6 +461,9 @@ jobs:
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
         if: success() && !env.SKIP_JOB
+      - name: install awscli
+        run: src/ci/scripts/install-awscli.sh
+        if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
         if: success() && !env.SKIP_JOB
@@ -578,6 +584,9 @@ jobs:
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
         if: success() && !env.SKIP_JOB
+      - name: install awscli
+        run: src/ci/scripts/install-awscli.sh
+        if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
         if: success() && !env.SKIP_JOB
diff --git a/src/ci/github-actions/ci.yml b/src/ci/github-actions/ci.yml
index 93b07350ac1..3db4dd4cdb2 100644
--- a/src/ci/github-actions/ci.yml
+++ b/src/ci/github-actions/ci.yml
@@ -153,6 +153,10 @@ x--expand-yaml-anchors--remove:
         run: src/ci/scripts/dump-environment.sh
         <<: *step
 
+      - name: install awscli
+        run: src/ci/scripts/install-awscli.sh
+        <<: *step
+
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
         <<: *step
diff --git a/src/ci/scripts/install-awscli.sh b/src/ci/scripts/install-awscli.sh
new file mode 100755
index 00000000000..b4a239fd3bc
--- /dev/null
+++ b/src/ci/scripts/install-awscli.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+# This script downloads and installs the awscli binaries directly from
+# Amazon.
+
+set -euo pipefail
+IFS=$'\n\t'
+
+source "$(cd "$(dirname "$0")" && pwd)/../shared.sh"
+
+AWS_VERSION="2.13.25"
+
+# Only the macOS arm64/aarch64 GitHub Actions runner needs to have AWS
+# installed; other platforms have it preinstalled.
+
+if isMacOS; then
+    platform=$(uname -m)
+    case $platform in
+        x86_64)
+            ;;
+        arm64)
+            file="https://awscli.amazonaws.com/AWSCLIV2-${AWS_VERSION}.pkg"
+            retry curl -f "${file}" -o "AWSCLIV2.pkg"
+            sudo installer -pkg "AWSCLIV2.pkg" -target /
+            ;;
+        *)
+            echo "unsupported architecture: ${platform}"
+            exit 1
+    esac
+fi