diff --git a/timdex_dataset_api/metadata.py b/timdex_dataset_api/metadata.py
index bfe3697..1b9506d 100644
--- a/timdex_dataset_api/metadata.py
+++ b/timdex_dataset_api/metadata.py
@@ -161,6 +161,14 @@ def _configure_duckdb_s3_secret(
         If a scope is provided, e.g. an S3 URI prefix like 's3://timdex', set a scope
         parameter in the config.  Else, leave it blank.
         """
+        # install httpfs extension
+        conn.execute(
+            """
+            install httpfs;
+            load httpfs;
+            """
+        )
+
         # establish scope string
         scope_str = f", scope '{scope}'" if scope else ""
 
@@ -186,7 +194,6 @@ def _configure_duckdb_s3_secret(
                 create or replace secret aws_s3_secret (
                     type s3,
                     provider credential_chain,
-                    chain 'sso;env;config',
                     refresh true
                     {scope_str}
                 );