diff --git a/openapi/management-open-api.yaml b/openapi/management-open-api.yaml
index da9f7d55..cacb0fb6 100644
--- a/openapi/management-open-api.yaml
+++ b/openapi/management-open-api.yaml
@@ -12761,6 +12761,10 @@ components:
         bucket:
           type: string
           description: Name of the S3 bucket
+        partition:
+          type: string
+          default: aws
+          description: AWS partition used when constructing S3 ARNs for vended-credential policies.
         endpoint:
           type:
             - string
diff --git a/package-lock.json b/package-lock.json
index cc76b257..406dc5de 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@lakekeeper/console-components",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@lakekeeper/console-components",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@codemirror/commands": "^6.10.3",
diff --git a/package.json b/package.json
index 1dd46af9..36ceb8af 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lakekeeper/console-components",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "A library of Vue components for Lakekeeper console applications",
   "type": "module",
   "main": "dist/console-components.umd.js",
diff --git a/src/components/WarehouseStorageFormS3.vue b/src/components/WarehouseStorageFormS3.vue
index c885653f..e1b46dca 100644
--- a/src/components/WarehouseStorageFormS3.vue
+++ b/src/components/WarehouseStorageFormS3.vue
@@ -32,6 +32,18 @@
 
     <!-- 2. How do we reach it? Only what this flavour actually needs. -->
     <v-row dense class="mb-3">
+      <v-col v-if="flavor === 'aws'" cols="12" md="6">
+        <v-combobox
+          density="compact"
+          v-model="profile.partition"
+          hint="AWS partition the bucket lives in — used to build ARNs for vended credentials"
+          persistent-hint
+          :items="s3Partitions"
+          label="Partition *"
+          :error="!profile.partition"
+          placeholder="aws"
+          :rules="[rules.required]"></v-combobox>
+      </v-col>
       <v-col cols="12" md="6">
         <v-combobox
           density="compact"
@@ -437,6 +449,8 @@ const profile = reactive<Record<string, any>>({
   bucket: '',
   region: props.flavor === 's3-compat' ? 'local' : '',
   flavor: props.flavor === 'aws' ? 'aws' : 's3-compat',
+  // Only AWS builds ARNs from a partition; the S3-compatible flavours have none.
+  ...(props.flavor === 'aws' ? { partition: 'aws' } : {}),
   'remote-signing-enabled': true,
   'sts-enabled': props.flavor === 'cloudflare-r2' || props.flavor === 'aliyun-oss',
 });
@@ -451,6 +465,10 @@ onMounted(() => {
   if (props.initial?.['storage-credential'])
     Object.assign(credential, props.initial['storage-credential']);
 
+  // Warehouses created before the field existed seed a profile without it. Set
+  // the default before the baseline is taken, so it does not read as an edit.
+  if (props.flavor === 'aws') profile.partition ??= 'aws';
+
   const layout = profile['storage-layout'];
   if (layout?.type) {
     layoutType.value = layout.type;
@@ -647,6 +665,16 @@ watch(
   { deep: true },
 );
 
+const s3Partitions = [
+  'aws',
+  'aws-cn',
+  'aws-us-gov',
+  'aws-iso',
+  'aws-iso-b',
+  'aws-iso-e',
+  'aws-iso-f',
+];
+
 const regions = [
   'us-east-1',
   'us-east-2',
diff --git a/src/gen/management/types.gen.ts b/src/gen/management/types.gen.ts
index c67f1d5f..43b4a46f 100644
--- a/src/gen/management/types.gen.ts
+++ b/src/gen/management/types.gen.ts
@@ -2446,6 +2446,10 @@ export type S3Profile = {
      * Name of the S3 bucket
      */
     bucket: string;
+    /**
+     * AWS partition used when constructing S3 ARNs for vended-credential policies.
+     */
+    partition?: string;
     /**
      * Optional endpoint to use for S3 requests, if not provided
      * the region will be used to determine the endpoint.