diff --git a/.github/workflows/akamai-test.yml b/.github/workflows/akamai-test.yml
index a1e87af11..f7bdcca8d 100644
--- a/.github/workflows/akamai-test.yml
+++ b/.github/workflows/akamai-test.yml
@@ -16,9 +16,10 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_CLOUDGATE_SECRET_KEY  }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
+          role=arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }}
           export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \
           $(aws sts assume-role \
-          --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \
+          --role-arn $role \
           --role-session-name gha-upload \
           --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
           --output text))
@@ -40,6 +41,8 @@ jobs:
 
   akamai-upload-via-script:
     name: Upload to Akamai via Script
+    needs: [ akamai-upload ]
+    id: gen-upload-2
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
@@ -67,5 +70,3 @@ jobs:
           echo $AWS_SESSION_TOKEN
           aws s3 mv ./$file s3://tools-spring-io/test-akamai/$file
           aws s3 rm s3://tools-spring-io/test-akamai/$file
-
-
diff --git a/concourse/pipeline.yml b/concourse/pipeline.yml
index b6cc9edc3..06f23e24c 100644
--- a/concourse/pipeline.yml
+++ b/concourse/pipeline.yml
@@ -18,6 +18,11 @@ resource_types:
   source:
     repository: springio/artifactory-resource
     tag: 0.0.10
+- name: semver
+  type: docker-image
+  source:
+    repository: concourse/semver-resource
+    tag: "1.7"
 #########################################################
 resources:
 - name: monthly
@@ -294,8 +299,9 @@ resources:
     driver: s3
     bucket: ((s3_bucket))
     key: versions/vscode-extensions
-    access_key_id: ((s3_accesskey))
-    secret_access_key: ((s3_secretkey))
+    access_key_id: ((s3_svc_accesskey))
+    secret_access_key: ((s3_svc_secretkey))
+    assume_role_arn: arn:aws:iam::((s3_svc_account_id)):role/((s3_svc_user))
     region_name: ((s3_region))
     initial_version: 0.0.5-RC.6
 - name: nightly