diff --git a/flink-sql-runner/src/main/docker/Dockerfile b/flink-sql-runner/src/main/docker/Dockerfile
index 7ad79e84..0d2815e0 100644
--- a/flink-sql-runner/src/main/docker/Dockerfile
+++ b/flink-sql-runner/src/main/docker/Dockerfile
@@ -57,6 +57,8 @@ COPY flink-sql-runner.uber.jar /opt/flink/lib/sql-runner.uber.jar
 COPY --chmod=755 sql-runner /opt/flink/bin/sql-runner
 COPY --chmod=755 entrypoint.sh /entrypoint.sh
 
+# noop.jar is an empty JAR. `flink run` requires a JAR positional argument, but the runner code
+# ships on the system classpath in lib/ (see bin/sql-runner), so this only satisfies the CLI.
 RUN echo 'UEsDBBQACAgIAG2UllwAAAAAAAAAAAAAAAAUAAQATUVUQS1JTkYvTUFOSUZFU1QuTUb+ygAA803My0xLLS7RDUstKs7Mz7NSMNQz4HIuSk0sSU3Rdaq0UkjLyczL1i0uzNEtKs3LSy3i4gIAUEsHCL/cUjU2AAAANAAAAFBLAQIUABQACAgIAG2Ully/3FI1NgAAADQAAAAUAAQAAAAAAAAAAAAAAAAAAABNRVRBLUlORi9NQU5JRkVTVC5NRv7KAABQSwUGAAAAAAEAAQBGAAAAfAAAAAAA' | base64 -d > /opt/flink/noop.jar \
     && mkdir -p /opt/flink/hadoop-conf \
     && echo '<configuration><property><name>fs.s3a.aws.credentials.provider</name><value>com.amazonaws.auth.DefaultAWSCredentialsProviderChain</value></property></configuration>' > /opt/flink/hadoop-conf/core-site.xml \
diff --git a/pom.xml b/pom.xml
index b5ec69ff..23f794a1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,6 +100,8 @@
     <assertj.version>3.27.7</assertj.version>
     <auto.service.version>1.1.1</auto.service.version>
     <awaitility.version>4.3.0</awaitility.version>
+    <!-- AWS SDK must be kept in sync with the version defined in "iceberg-aws-bundle" -->
+    <awssdk.version>2.44.4</awssdk.version>
     <aws-msk-iam-auth.version>2.3.7</aws-msk-iam-auth.version>
     <classgraph.version>4.8.186</classgraph.version>
     <commons-exec.version>1.6.0</commons-exec.version>
@@ -165,6 +167,14 @@
         <scope>import</scope>
       </dependency>
 
+      <dependency>
+        <groupId>software.amazon.awssdk</groupId>
+        <artifactId>bom</artifactId>
+        <version>${awssdk.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>com.google.auto.service</groupId>
         <artifactId>auto-service</artifactId>