diff --git a/.changeset/breezy-starfishes-rhyme.md b/.changeset/breezy-starfishes-rhyme.md
new file mode 100644
index 0000000000..5c624ac514
--- /dev/null
+++ b/.changeset/breezy-starfishes-rhyme.md
@@ -0,0 +1,5 @@
+---
+"@latticexyz/cli": patch
+---
+
+Fixed `mud deploy` to not require the `PRIVATE_KEY` environment variable when using a KMS signer.
diff --git a/packages/cli/src/runDeploy.ts b/packages/cli/src/runDeploy.ts
index 1ab195b4bd..099a1368eb 100644
--- a/packages/cli/src/runDeploy.ts
+++ b/packages/cli/src/runDeploy.ts
@@ -84,19 +84,25 @@ export async function runDeploy(opts: DeployOptions): Promise<WorldDeploy> {
     await build({ config: configV2, srcDir, foundryProfile: profile });
   }
 
-  const privateKey = process.env.PRIVATE_KEY as Hex;
-  if (!privateKey) {
-    throw new MUDError(
-      `Missing PRIVATE_KEY environment variable.
-Run 'echo "PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80" > .env'
-in your contracts directory to use the default anvil private key.`,
-    );
-  }
-
   const resolvedConfig = resolveConfig({ config, forgeSourceDir: srcDir, forgeOutDir: outDir });
 
-  const keyId = opts.awsKmsKeyId ?? process.env.AWS_KMS_KEY_ID;
-  const account = keyId ? await kmsKeyToAccount({ keyId }) : privateKeyToAccount(privateKey);
+  const account = await (async () => {
+    if (opts.awsKmsKeyId) {
+      const keyId = opts.awsKmsKeyId ?? process.env.AWS_KMS_KEY_ID;
+      return await kmsKeyToAccount({ keyId });
+    } else {
+      const privateKey = process.env.PRIVATE_KEY;
+      if (!privateKey) {
+        throw new MUDError(
+          `Missing PRIVATE_KEY environment variable.
+  Run 'echo "PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80" > .env'
+  in your contracts directory to use the default anvil private key.`,
+        );
+      }
+
+      return privateKeyToAccount(privateKey as Hex);
+    }
+  })();
 
   const client = createWalletClient({
     transport: http(rpc, {