diff --git a/scripts/fixup-checksums.ts b/scripts/fixup-checksums.ts
index aa8116ca..d0519b06 100755
--- a/scripts/fixup-checksums.ts
+++ b/scripts/fixup-checksums.ts
@@ -5,7 +5,7 @@ args:
   - deno
   - run
   - --allow-net
-  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,S3_BUCKET
+  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_S3_BUCKET
   - --import-map={{ srcroot }}/import-map.json
 ---*/
 
diff --git a/scripts/inventory.ts b/scripts/inventory.ts
index 6958add7..42412fdc 100755
--- a/scripts/inventory.ts
+++ b/scripts/inventory.ts
@@ -5,7 +5,8 @@ args:
   - deno
   - run
   - --allow-net
-  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,S3_BUCKET,AWS_S3
+  - --allow-read
+  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_S3_BUCKET
   - --import-map={{ srcroot }}/import-map.json
 ---*/
 
diff --git a/scripts/upload-sync.ts b/scripts/upload-sync.ts
index 092eb44a..e54f8c29 100755
--- a/scripts/upload-sync.ts
+++ b/scripts/upload-sync.ts
@@ -4,9 +4,9 @@
 args:
   - deno
   - run
+  - --allow-read
   - --allow-net
-  - --allow-read={{ tea.prefix }}/tea.xyz/var/www
-  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,S3_BUCKET,AWS_S3
+  - --allow-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_S3_BUCKET,TEA_PREFIX
   - --import-map={{ srcroot }}/import-map.json
 ---*/