@@ -278,14 +278,14 @@ This depends on the runtime. The published images run Bun. If you build the stan
 | Everything through the SSRF guard — SSO OIDC discovery, the HTTP block, tools, connectors, outbound webhooks, content fetches, MCP servers, and model endpoints typed into a block | Yes — see [Proxying guarded requests](#proxying-guarded-requests) |
 | SSO sign-in — the token, JWKS, and userinfo calls made while a user signs in | Yes — they use the default `fetch` |
 | SSO domain verification (TXT lookup) | No — DNS, sent to `1.1.1.1` and `8.8.8.8` unless `DOMAIN_VERIFICATION_NAMESERVERS` names your resolvers |
-| Amazon Bedrock, and object storage on S3 | No — the AWS SDK uses its own request handler |
-| Email via SMTP | No — Nodemailer opens a raw TCP connection |
-| Email via Amazon SES | No — the AWS SDK transport, over HTTPS |
-| OTLP export from the server SDK | No |
+| Amazon Bedrock, object storage on S3, and every AWS integration (DynamoDB, SQS, Lambda, Textract, and the rest) | Yes — each AWS client gets a proxy-aware agent while a proxy is set. Bedrock then uses HTTP/1.1 instead of HTTP/2 |
+| Email via SMTP, and the SMTP block | No — SMTP is not HTTP. Use a mail relay the app can reach directly, or Resend or SES |
+| Email via Amazon SES | Yes — the AWS SDK client above |
+| OTLP export from the server SDK | Yes — the exporters get the same proxy-aware agent |
 | The `/api/telemetry` relay that forwards browser events | Yes — it uses the default `fetch` |
 | Postgres and Redis | No — raw TCP |
 
-The practical consequence: a mandatory-egress-proxy environment can route LLM traffic, SSO, integration and workflow HTTP calls, Resend mail, and Azure/GCS storage through the proxy, but S3, Bedrock, SMTP, SES, OTLP export, and datastore traffic still need a transparent proxy or NAT-based egress.
+The practical consequence: a mandatory-egress-proxy environment can route LLM traffic, SSO, integration and workflow HTTP calls, Resend mail, Azure/GCS storage, AWS services, SES, and OTLP export through the proxy. SMTP and datastore traffic (Postgres, Redis, and the database blocks) still need a transparent proxy or NAT-based egress.
 
 ### Proxying guarded requests
 
@@ -299,7 +299,7 @@ A request through the SSRF guard keeps its checks when it is proxied. Before eac
 
 ### Internal destinations and `NO_PROXY`
 
-Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference.
+Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference. AWS clients and OTLP export follow the same rule, so also add an internal S3-compatible store such as MinIO, AWS VPC endpoints, and an in-cluster OpenTelemetry collector.
 
 Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 
 
@@ -176,6 +176,8 @@ async function initializeOpenTelemetry() {
     const { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION, ATTR_DEPLOYMENT_ENVIRONMENT } = await import(
       '@opentelemetry/semantic-conventions/incubating'
     )
+    const { otlpExporterProxyOptions } = await import('./lib/core/network/proxy-agent.server')
+    const exporterProxyOptions = otlpExporterProxyOptions()
     const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http')
     const { OTLPMetricExporter } = await import('@opentelemetry/exporter-metrics-otlp-http')
     const { PeriodicExportingMetricReader } = await import('@opentelemetry/sdk-metrics')
@@ -236,6 +238,7 @@ async function initializeOpenTelemetry() {
       headers: otlpHeaders,
       timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
       keepAlive: false,
+      ...exporterProxyOptions,
     })
 
     // Surface export failures (BatchSpanProcessor swallows them otherwise).
@@ -273,6 +276,7 @@ async function initializeOpenTelemetry() {
             headers: otlpHeaders,
             timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
             keepAlive: false,
+            ...exporterProxyOptions,
           }),
           exportIntervalMillis: 60000,
         })
@@ -289,6 +293,7 @@ async function initializeOpenTelemetry() {
             headers: otlpHeaders,
             timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
             keepAlive: false,
+            ...exporterProxyOptions,
           }),
         })
 
 
@@ -4,6 +4,7 @@ import { SQSClient } from '@aws-sdk/client-sqs'
 import { fromHttp } from '@aws-sdk/credential-providers'
 import { getAwsCredentials } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 
 /**
  * The Entitlement Service exists only here. Metering is multi-region, but a registration token is
@@ -38,7 +39,7 @@ function marketplaceClientConfig() {
   const fullUri = env.AWS_CONTAINER_CREDENTIALS_FULL_URI
   return {
     region: MARKETPLACE_REGION,
-    requestHandler: REQUEST_HANDLER,
+    requestHandler: awsRequestHandler(REQUEST_HANDLER),
     credentials:
       relativeUri || fullUri
         ? fromHttp({
 
@@ -10,6 +10,7 @@ import { toRecordOrNull } from '@sim/utils/object'
 import { LRUCache } from 'lru-cache'
 import { getAwsCredentials } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 
 const logger = createLogger('AppConfig')
 
@@ -122,6 +123,7 @@ function getClient(): AppConfigDataClient {
     client = new AppConfigDataClient({
       region: env.AWS_REGION,
       credentials: getAwsCredentials(),
+      requestHandler: awsRequestHandler(),
     })
   }
   return client
 
@@ -9,8 +9,10 @@ import type { Duplex } from 'node:stream'
 import { getCACertificates, setDefaultCACertificates } from 'node:tls'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
+import { ListBucketsCommand, S3Client } from '@aws-sdk/client-s3'
 import { networkConfigMock } from '@sim/testing/mocks/network-config.mock'
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { NodeHttpHandler } from '@smithy/node-http-handler'
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/core/network/config.server', () => networkConfigMock)
 vi.mock('@sim/security/dns', async (importOriginal) => {
@@ -29,6 +31,8 @@ vi.mock('@sim/security/dns', async (importOriginal) => {
   }
 })
 
+import { resolveEnvironmentProxy } from '@/lib/core/network/environment-proxy.server'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 import {
   createPinnedFetchWithDispatcher,
   createSsrfGuardedFetchWithDispatcher,
@@ -53,6 +57,11 @@ const secureOrigin = httpsServer((req, res) => {
     res.end()
     return
   }
+  if (String(req.headers.authorization).startsWith('AWS4-HMAC-SHA256')) {
+    res.setHeader('content-type', 'application/xml')
+    res.end('<ListAllMyBucketsResult><Buckets></Buckets></ListAllMyBucketsResult>')
+    return
+  }
   res.end('tls reached')
 })
 
@@ -133,10 +142,6 @@ beforeEach(() => {
   originHeaders = {}
 })
 
-afterEach(() => {
-  vi.unstubAllEnvs()
-})
-
 afterAll(async () => {
   for (const socket of sockets) socket.destroy()
   await Promise.all(
@@ -244,7 +249,7 @@ describe('guarded requests under HTTPS_PROXY', () => {
     ])
   })
 
-  it('tunnels through the proxy under the actual Bun runtime', async () => {
+  it('tunnels guarded fetches and AWS SDK requests under the actual Bun runtime', async () => {
     await promisify(execFile)(
       'bun',
       [
@@ -266,6 +271,91 @@ describe('guarded requests under HTTPS_PROXY', () => {
         },
       }
     )
-    expect(tunnels).toEqual([{ authority: '1.1.1.1:443', authorization: PROXY_AUTHORIZATION }])
+    expect(tunnels).toEqual([
+      { authority: '1.1.1.1:443', authorization: PROXY_AUTHORIZATION },
+      { authority: '1.1.1.1:443', authorization: PROXY_AUTHORIZATION },
+    ])
+  })
+})
+
+describe('proxy selection from the environment', () => {
+  it.each([
+    {
+      case: 'an empty lowercase variable does not hide the uppercase one',
+      env: { https_proxy: '', HTTPS_PROXY: 'http://upper:3128' },
+      target: 'https://api.example.com/',
+      proxy: 'http://upper:3128/',
+    },
+    {
+      case: 'an https destination falls back to HTTP_PROXY',
+      env: { HTTP_PROXY: 'http://plain:3128' },
+      target: 'https://api.example.com/',
+      proxy: 'http://plain:3128/',
+    },
+    {
+      case: 'a bare host:port is read as an http proxy',
+      env: { HTTPS_PROXY: 'proxy.internal:3128' },
+      target: 'https://api.example.com/',
+      proxy: 'http://proxy.internal:3128/',
+    },
+    {
+      case: 'a NO_PROXY entry with a port only excludes that port',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: 'api.example.com:8443' },
+      target: 'https://api.example.com/',
+      proxy: 'http://p:3128/',
+    },
+    {
+      case: 'NO_PROXY=* excludes every destination',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '*' },
+      target: 'https://api.example.com/',
+      proxy: null,
+    },
+  ])('$case', ({ env, target, proxy }) => {
+    for (const name of PROXY_ENV) vi.stubEnv(name, '')
+    for (const [name, value] of Object.entries(env)) vi.stubEnv(name, value)
+    expect(resolveEnvironmentProxy(new URL(target))).toBe(proxy)
+  })
+
+  it('fails closed instead of going direct when the proxy URL is unsupported', async () => {
+    vi.stubEnv('HTTPS_PROXY', 'socks5://127.0.0.1:1080')
+    await expect(secureFetchWithValidation('https://origin.invalid/', options)).rejects.toThrow(
+      /http:\/\/ or https:\/\//
+    )
+    expect(tunnels).toEqual([])
+    expect(originHeaders).toEqual({})
+  })
+})
+
+describe('AWS SDK clients under HTTPS_PROXY', () => {
+  const listBuckets = (endpoint: string) =>
+    new S3Client({
+      region: 'us-east-1',
+      endpoint,
+      forcePathStyle: true,
+      credentials: { accessKeyId: 'AKIDEXAMPLE', secretAccessKey: 'secret' },
+      requestHandler: awsRequestHandler(),
+    }).send(new ListBucketsCommand({}))
+
+  it('tunnels SDK requests by hostname and keeps proxy credentials off the origin', async () => {
+    await expect(listBuckets('https://origin.invalid')).resolves.toMatchObject({ Buckets: [] })
+    expect(tunnels).toEqual([
+      { authority: 'origin.invalid:443', authorization: PROXY_AUTHORIZATION },
+    ])
+    expect(originHeaders['proxy-authorization']).toBeUndefined()
+  })
+
+  it('connects directly when NO_PROXY names the endpoint', async () => {
+    vi.stubEnv('NO_PROXY', '127.0.0.1')
+    await expect(listBuckets(`https://127.0.0.1:${securePort}`)).resolves.toMatchObject({
+      Buckets: [],
+    })
+    expect(tunnels).toEqual([])
+  })
+
+  it('leaves the SDK defaults untouched when no proxy is configured', () => {
+    vi.stubEnv('HTTPS_PROXY', '')
+    vi.stubEnv('HTTP_PROXY', '')
+    expect(awsRequestHandler({ requestTimeout: 10_000 })).not.toBeInstanceOf(NodeHttpHandler)
+    expect(awsRequestHandler()).toBeUndefined()
   })
 })
@@ -1,11 +1,15 @@
 const DEFAULT_PORTS: Record<string, number> = { 'http:': 80, 'https:': 443 }
-const SUPPORTED_PROXY_PROTOCOLS = new Set(['http:', 'https:'])
 
 /** An empty lowercase variable counts as unset, so it cannot hide the uppercase one. */
 function readEnv(lower: string, upper: string): string | undefined {
   return process.env[lower]?.trim() || process.env[upper]?.trim() || undefined
 }
 
+/** Whether any `HTTPS_PROXY` / `HTTP_PROXY` is set, before any destination is considered. */
+export function isEnvironmentProxyConfigured(): boolean {
+  return Boolean(readEnv('https_proxy', 'HTTPS_PROXY') ?? readEnv('http_proxy', 'HTTP_PROXY'))
+}
+
 /** Matches `NO_PROXY` the way undici's `EnvHttpProxyAgent` does, so both stacks agree. */
 function isExcludedByNoProxy(hostname: string, port: number): boolean {
   const noProxy = readEnv('no_proxy', 'NO_PROXY')
@@ -35,9 +39,7 @@ export function resolveEnvironmentProxy(target: URL): string | null {
   const proxy =
     target.protocol === 'https:' ? (readEnv('https_proxy', 'HTTPS_PROXY') ?? httpProxy) : httpProxy
   if (!proxy) return null
-  const hostname = target.host.replace(/:\d*$/, '').toLowerCase()
-  const port = Number.parseInt(target.port, 10) || defaultPort
-  if (isExcludedByNoProxy(hostname, port)) return null
+  if (isExcludedByNoProxy(target.hostname, Number(target.port) || defaultPort)) return null
   return normalizeProxyUrl(proxy)
 }
 
@@ -49,7 +51,7 @@ function normalizeProxyUrl(value: string): string {
   } catch {
     throw new Error('The configured HTTP(S)_PROXY is not a valid URL')
   }
-  if (!SUPPORTED_PROXY_PROTOCOLS.has(parsed.protocol)) {
+  if (DEFAULT_PORTS[parsed.protocol] === undefined) {
     throw new Error('The configured HTTP(S)_PROXY must be an http:// or https:// URL')
   }
   return parsed.href
 
@@ -1,4 +1,6 @@
 /** Real runtime probe invoked by environment-proxy.server.test.ts against its local proxy. */
+import { ListBucketsCommand, S3Client } from '@aws-sdk/client-s3'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
 
 const response = await secureFetchWithValidation(
@@ -7,3 +9,13 @@ const response = await secureFetchWithValidation(
 )
 if (response.headers.get('x-via-proxy') !== 'yes') throw new Error('Guarded fetch bypassed proxy')
 if ((await response.text()) !== 'tls reached') throw new Error('Guarded fetch response mismatch')
+
+const buckets = await new S3Client({
+  region: 'us-east-1',
+  endpoint: 'https://1.1.1.1',
+  forcePathStyle: true,
+  credentials: { accessKeyId: 'AKIDEXAMPLE', secretAccessKey: 'secret' },
+  requestHandler: awsRequestHandler(),
+}).send(new ListBucketsCommand({}))
+if (!Array.isArray(buckets.Buckets)) throw new Error('AWS SDK response mismatch')
+process.exit(0)
@@ -0,0 +1,82 @@
+import http from 'node:http'
+import https from 'node:https'
+import { isIP } from 'node:net'
+import { NodeHttpHandler } from '@smithy/node-http-handler'
+import { Agent, type AgentConnectOpts } from 'agent-base'
+import { HttpProxyAgent } from 'http-proxy-agent'
+import { HttpsProxyAgent } from 'https-proxy-agent'
+import {
+  isEnvironmentProxyConfigured,
+  resolveEnvironmentProxy,
+} from '@/lib/core/network/environment-proxy.server'
+
+/** Matches the AWS SDK's own default agent, so swapping it in changes routing and nothing else. */
+const AGENT_OPTIONS: http.AgentOptions = { keepAlive: true, maxSockets: 50 }
+
+/**
+ * A Node agent for SDKs that bring their own HTTP stack (the AWS SDK, the OTLP exporters) and so
+ * bypass Bun's proxy-aware `fetch`. Each connection takes the `HTTPS_PROXY` / `HTTP_PROXY` that
+ * applies to its destination, or a direct keep-alive connection when `NO_PROXY` excludes it.
+ */
+class EnvironmentProxyAgent extends Agent {
+  private readonly direct = {
+    http: new http.Agent(AGENT_OPTIONS),
+    https: new https.Agent(AGENT_OPTIONS),
+  }
+  private readonly proxies = new Map<string, http.Agent>()
+
+  connect(_req: http.ClientRequest, options: AgentConnectOpts): http.Agent {
+    const secure = options.secureEndpoint
+    const host = options.host ?? 'localhost'
+    const authority = isIP(host) === 6 ? `[${host}]` : host
+    const target = new URL(`${secure ? 'https' : 'http'}://${authority}:${options.port}`)
+    const proxyUrl = resolveEnvironmentProxy(target)
+    if (!proxyUrl) return secure ? this.direct.https : this.direct.http
+    const key = `${target.protocol}${proxyUrl}`
+    let agent = this.proxies.get(key)
+    if (!agent) {
+      agent = secure
+        ? new HttpsProxyAgent(proxyUrl, AGENT_OPTIONS)
+        : new HttpProxyAgent(proxyUrl, AGENT_OPTIONS)
+      this.proxies.set(key, agent)
+    }
+    return agent
+  }
+}
+
+let sharedAgent: EnvironmentProxyAgent | null = null
+
+/** The process-wide {@link EnvironmentProxyAgent}; only meaningful while a proxy is configured. */
+function environmentProxyAgent(): EnvironmentProxyAgent {
+  sharedAgent ??= new EnvironmentProxyAgent(AGENT_OPTIONS)
+  return sharedAgent
+}
+
+interface AwsRequestHandlerOptions {
+  connectionTimeout?: number
+  requestTimeout?: number
+  throwOnRequestTimeout?: boolean
+}
+
+/**
+ * `requestHandler` for an AWS SDK v3 client. The SDK's Node handlers ignore `HTTPS_PROXY`, so while
+ * a proxy is configured this returns an HTTP/1.1 handler on {@link environmentProxyAgent} — which
+ * also replaces the HTTP/2 handler some clients default to, since HTTP/2 cannot use an agent.
+ * Without a proxy it returns `options` unchanged and the SDK keeps its own defaults.
+ */
+export function awsRequestHandler(
+  options?: AwsRequestHandlerOptions
+): NodeHttpHandler | AwsRequestHandlerOptions | undefined {
+  if (!isEnvironmentProxyConfigured()) return options
+  const agent = environmentProxyAgent()
+  return new NodeHttpHandler({ ...options, httpAgent: agent, httpsAgent: agent })
+}
+
+/**
+ * Agent settings for an OTLP HTTP exporter, which sends through `node:http` and so ignores
+ * `HTTPS_PROXY`. Empty without a proxy, leaving the exporter's own agent in place.
+ */
+export function otlpExporterProxyOptions(): { httpAgentOptions?: () => http.Agent } {
+  if (!isEnvironmentProxyConfigured()) return {}
+  return { httpAgentOptions: environmentProxyAgent }
+}