diff --git a/.github/workflows/pathogen-repo-build.yaml b/.github/workflows/pathogen-repo-build.yaml
index b645886..2e3a274 100644
--- a/.github/workflows/pathogen-repo-build.yaml
+++ b/.github/workflows/pathogen-repo-build.yaml
@@ -287,7 +287,7 @@ jobs:
           "$NEXTSTRAIN_GITHUB_DIR"/bin/write-envdir "$NEXTSTRAIN_RUNTIME_ENVDIR" \
             AWS_ACCESS_KEY_ID \
             AWS_SECRET_ACCESS_KEY \
-            AWS_SESSION_TOKEN
+            ${AWS_SESSION_TOKEN:+AWS_SESSION_TOKEN}
         # This will overwrite the runtime AWS credential envvars configured above
         # so if the build is using the aws-batch runtime, the Nextstrain CLI will
         # have access to the AWS Batch session credentials
diff --git a/.github/workflows/pathogen-repo-build.yaml.in b/.github/workflows/pathogen-repo-build.yaml.in
index 2e7b031..72427d1 100644
--- a/.github/workflows/pathogen-repo-build.yaml.in
+++ b/.github/workflows/pathogen-repo-build.yaml.in
@@ -256,7 +256,7 @@ jobs:
           "$NEXTSTRAIN_GITHUB_DIR"/bin/write-envdir "$NEXTSTRAIN_RUNTIME_ENVDIR" \
             AWS_ACCESS_KEY_ID \
             AWS_SECRET_ACCESS_KEY \
-            AWS_SESSION_TOKEN
+            ${AWS_SESSION_TOKEN:+AWS_SESSION_TOKEN}
 
     # This will overwrite the runtime AWS credential envvars configured above
     # so if the build is using the aws-batch runtime, the Nextstrain CLI will