diff --git a/crates/s3/src/client.rs b/crates/s3/src/client.rs
index f52eec2..fe93553 100644
--- a/crates/s3/src/client.rs
+++ b/crates/s3/src/client.rs
@@ -1683,7 +1683,7 @@ impl ObjectStore for S3Client {
             .list_buckets()
             .send()
             .await
-            .map_err(|e| Error::Network(e.to_string()))?;
+            .map_err(|e| Error::Network(Self::format_sdk_error(&e)))?;
 
         let buckets = response
             .buckets()
@@ -1848,7 +1848,7 @@ impl ObjectStore for S3Client {
             .bucket(bucket)
             .send()
             .await
-            .map_err(|e| Error::Network(e.to_string()))?;
+            .map_err(|e| Error::Network(Self::format_sdk_error(&e)))?;
 
         Ok(())
     }
@@ -3981,6 +3981,52 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn list_buckets_preserves_service_error_code() {
+        let response = http::Response::builder()
+            .status(403)
+            .header("x-amz-error-code", "InvalidAccessKeyId")
+            .body(SdkBody::from(
+                r#"<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>InvalidAccessKeyId</Code>
+  <Message>The AWS access key Id you provided does not exist in our records.</Message>
+</Error>"#,
+            ))
+            .expect("build list buckets response");
+        let (client, _request_receiver) = test_s3_client(Some(response));
+
+        let result = client.list_buckets().await;
+
+        match result {
+            Err(Error::Network(message)) => assert!(message.contains("InvalidAccessKeyId")),
+            other => panic!("Expected Network for list buckets failure, got: {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn create_bucket_preserves_service_error_code() {
+        let response = http::Response::builder()
+            .status(403)
+            .header("x-amz-error-code", "InvalidAccessKeyId")
+            .body(SdkBody::from(
+                r#"<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>InvalidAccessKeyId</Code>
+  <Message>The AWS access key Id you provided does not exist in our records.</Message>
+</Error>"#,
+            ))
+            .expect("build create bucket response");
+        let (client, _request_receiver) = test_s3_client(Some(response));
+
+        let result = client.create_bucket("bucket").await;
+
+        match result {
+            Err(Error::Network(message)) => assert!(message.contains("InvalidAccessKeyId")),
+            other => panic!("Expected Network for create bucket failure, got: {other:?}"),
+        }
+    }
+
     #[tokio::test]
     async fn delete_bucket_maps_bucket_not_empty_to_conflict() {
         let response = http::Response::builder()