see

.github/workflows/release_rpk_connect_plugin_dry_run.yml

@@ -12,6 +12,15 @@ jobs:
     # Let's make this fast
     runs-on: ubuntu-latest-32
     steps:
+
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+        with:
+          secret-ids: |
+            ,sdlc/prod/github/rpk_plugin_publisher
+          parse-json-secrets: true
+
+      - run: "ACCESS_THING ${{ env.RPK_PLUGIN_PUBLISHER_AWS_ACCESS_KEY_ID }}"
+
       - name: Check Out Repo
         uses: actions/checkout@v4
 
@@ -31,11 +40,7 @@ jobs:
           version: 1.26.2
           args: build --timeout 120m
 
-      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
-        with:
-          secret-ids: |
-            ,sdlc/prod/github/rpk_plugin_publisher
-          parse-json-secrets: true
+
 
       - name: Upload binaries as rpk managed plugin
         uses: ./.github/actions/upload_managed_plugin