diff --git a/cmd/docs/main.go b/cmd/docs/main.go
index 8770f32463..8c2339aacb 100644
--- a/cmd/docs/main.go
+++ b/cmd/docs/main.go
@@ -34,7 +34,7 @@ func main() {
 	// Generate documentation for both subsets of commands: cloud and on-prem
 	configs := []*config.Config{
 		{CurrentContext: "Cloud", Contexts: map[string]*config.Context{"Cloud": {PlatformName: "https://confluent.cloud"}}},
-		{CurrentContext: "On-Premises", Contexts: map[string]*config.Context{"On-Premises": {PlatformName: "https://example.com"}}},
+		{CurrentContext: "Confluent Platform", Contexts: map[string]*config.Context{"Confluent Platform": {PlatformName: "https://example.com"}}},
 	}
 
 	tabs := make([]docs.Tab, len(configs))
diff --git a/go.mod b/go.mod
index e8cce4fac9..b0a8a18fac 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.26.5
 
 require (
 	github.com/antihax/optional v1.0.0
-	github.com/aws/aws-sdk-go v1.54.15
+	github.com/aws/aws-sdk-go-v2 v1.26.1
 	github.com/billgraziano/dpapi v0.5.0
 	github.com/bradleyjkemp/cupaloy/v2 v2.8.0
 	github.com/brianstrauch/cobra-shell v0.5.0
@@ -145,7 +145,6 @@ require (
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
 	github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.27.10 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.10 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
diff --git a/go.sum b/go.sum
index e1aba52bde..69d3c274b0 100644
--- a/go.sum
+++ b/go.sum
@@ -79,8 +79,6 @@ github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go v1.54.15 h1:ErgCEVbzuSfuZl9nR+g8FFnzjgeJ/AqAGOEWn6tgAHo=
-github.com/aws/aws-sdk-go v1.54.15/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
 github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
 github.com/aws/aws-sdk-go-v2/config v1.27.10 h1:PS+65jThT0T/snC5WjyfHHyUgG+eBoupSDV+f838cro=
diff --git a/internal/byok/command_create.go b/internal/byok/command_create.go
index 0811eeb6e9..86cac8dd16 100644
--- a/internal/byok/command_create.go
+++ b/internal/byok/command_create.go
@@ -8,7 +8,7 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/spf13/cobra"
 
 	byokv1 "github.com/confluentinc/ccloud-sdk-go-v2/byok/v1"
diff --git a/internal/byok/command_create_test.go b/internal/byok/command_create_test.go
index a73aad7ad9..7346a71017 100644
--- a/internal/byok/command_create_test.go
+++ b/internal/byok/command_create_test.go
@@ -7,6 +7,35 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestIsAWSKey(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected bool
+	}{
+		{
+			name:     "valid AWS KMS key ARN",
+			input:    "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+			expected: true,
+		},
+		{
+			name:     "valid ARN for a non-KMS service",
+			input:    "arn:aws:iam::111122223333:user/David",
+			expected: false,
+		},
+		{
+			name:     "not an ARN at all",
+			input:    "projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key",
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, isAWSKey(test.input))
+		})
+	}
+}
+
 func TestRemoveKeyVersionFromAzureKeyId(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/internal/login/command.go b/internal/login/command.go
index d71c27b258..263cd148d0 100644
--- a/internal/login/command.go
+++ b/internal/login/command.go
@@ -405,17 +405,23 @@ func validateURL(url string, isCCloud bool) (string, string, error) {
 		msg = append(msg, "default MDS port 8090")
 	}
 
-	var pattern *regexp.Regexp
 	if isCCloud {
-		pattern = regexp.MustCompile(`^\w+://[^/ ]+`)
-	} else {
-		pattern = regexp.MustCompile(`^\w+://[^/ ]+:\d+(?:\/|$)`)
+		pattern := regexp.MustCompile(`^\w+://[^/ ]+`)
+		if !pattern.MatchString(url) {
+			return "", "", fmt.Errorf(errors.InvalidLoginURLErrorMsg)
+		}
+		return url, strings.Join(msg, " and "), nil
 	}
-	if !pattern.MatchString(url) {
+
+	// discard any path after the host:port, so a trailing path (e.g. copied from a browser address
+	// bar) doesn't get baked into the base URL used for every subsequent request
+	pattern := regexp.MustCompile(`^(\w+://[^/ ]+:\d+)(?:/|$)`)
+	matches := pattern.FindStringSubmatch(url)
+	if matches == nil {
 		return "", "", fmt.Errorf(errors.InvalidLoginURLErrorMsg)
 	}
 
-	return url, strings.Join(msg, " and "), nil
+	return matches[1], strings.Join(msg, " and "), nil
 }
 
 func (c *command) getOrganizationId(cmd *cobra.Command) string {
diff --git a/internal/login/command_test.go b/internal/login/command_test.go
index d57c7c3c3e..5c05f4bfac 100644
--- a/internal/login/command_test.go
+++ b/internal/login/command_test.go
@@ -768,6 +768,18 @@ func TestValidateUrl(t *testing.T) {
 			urlOut:     "https://127.0.0.1:8090",
 			warningMsg: "",
 		},
+		{
+			// trailing path must be stripped, not baked into the base URL
+			urlIn:      "https://infra.confluentgov.internal.com:8090/login",
+			urlOut:     "https://infra.confluentgov.internal.com:8090",
+			warningMsg: "",
+		},
+		{
+			urlIn:      "infra.confluentgov.internal.com/login",
+			urlOut:     "",
+			warningMsg: "https protocol and default MDS port 8090",
+			errMsg:     errors.InvalidLoginURLErrorMsg,
+		},
 		{
 			urlIn:      "127.0.0.1",
 			urlOut:     "https://127.0.0.1:8090",