diff --git a/hack/microvm-assets/stage-to-rustfs.sh b/hack/microvm-assets/stage-to-rustfs.sh
index e0d3af4a10..75b3a5cf5f 100755
--- a/hack/microvm-assets/stage-to-rustfs.sh
+++ b/hack/microvm-assets/stage-to-rustfs.sh
@@ -44,9 +44,13 @@ KUBECTL_CONTEXT="${KUBECTL_CONTEXT:-}"
 KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-${KUBECTL_CONTEXT#kind-}}"
 KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
 
-# Keep in sync with the rustfs-bucket-init Job in
-# manifests/ate-install/kind/rustfs.yaml, which creates the bucket we upload into.
-AWS_CLI_IMAGE="amazon/aws-cli:2.17.0@sha256:643507c10ada7964ca6157b3d799f030b90577643da9955d319a77399ed80d73"
+# Deliberately ahead of the rustfs-bucket-init Job in
+# manifests/ate-install/kind/rustfs.yaml, which still pins 2.17.0: the botocore
+# vendored into 2.17 has no IPv6 endpoint validator and rejects a bracketed literal
+# outright, which is the only endpoint this script can build when IP_FAMILY=ipv6.
+# The Job addresses rustfs by DNS name, so it is unaffected and not worth forcing a
+# fresh in-cluster pull on every family. Do not go below 2.31 here.
+AWS_CLI_IMAGE="amazon/aws-cli:2.31.0@sha256:3b018ce74732c98acf6f1de59b3a89587cb7f9eb6ea0d1447d1779091b2bf057"
 
 ASSETS=(cloud-hypervisor virtiofsd vmlinux rootfs.img configuration-clh.toml)
 
@@ -76,7 +80,13 @@ if [[ -z "${NODE}" ]]; then
   echo "error: no nodes found for kind cluster '${KIND_CLUSTER_NAME}'" >&2
   exit 1
 fi
-ENDPOINT="http://$(run_kubectl get svc rustfs -o jsonpath='{.spec.clusterIP}'):9000"
+RUSTFS_IP="$(run_kubectl get svc rustfs -o jsonpath='{.spec.clusterIP}')"
+# On an IPv6-only cluster the ClusterIP is a v6 literal, which needs brackets to
+# be a URL at all.
+if [[ "${RUSTFS_IP}" == *:* ]]; then
+  RUSTFS_IP="[${RUSTFS_IP}]"
+fi
+ENDPOINT="http://${RUSTFS_IP}:9000"
 
 echo ">> Uploading assets to s3://${BUCKET}/kata-assets/ via ${ENDPOINT} (netns of ${NODE})..."
 aws_cli() {