diff --git a/.github/workflows/deploy-lambdas.yml b/.github/workflows/deploy-lambdas.yml
index 9af9e04f242..8723c0bd88e 100644
--- a/.github/workflows/deploy-lambdas.yml
+++ b/.github/workflows/deploy-lambdas.yml
@@ -32,9 +32,9 @@ jobs:
         run: |
             BUILDER_IMAGE=quiltdata/lambda:build-3.8
 
-            docker pull $BUILDER_IMAGE
+            docker pull "$BUILDER_IMAGE"
 
-            touch ./out.zip  # 🤦‍♂️
+            touch ./out.zip
 
             docker run --rm \
               --entrypoint /build_zip.sh \
@@ -42,7 +42,7 @@ jobs:
               -v "$PWD/lambdas/shared":/lambda/shared:z \
               -v "$PWD/out.zip":/out.zip:z \
               -v "$PWD/lambdas/build_zip.sh":/build_zip.sh:z \
-              $BUILDER_IMAGE
+              "$BUILDER_IMAGE"
       - name: Configure AWS credentials from Prod account
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -50,25 +50,8 @@ jobs:
           aws-region: us-east-1
       - name: Upload zips to Prod S3
         run: |
-            primary_region=us-east-1
-            regions=$(aws ec2 describe-regions --query "Regions[].{Name:RegionName}" --output text)
-
-            lambda_name=$(basename "$(pwd)")
-            s3_key="$lambda_name/${{ github.sha }}.zip"
-
-            echo "Uploading to $primary_region..."
-            aws s3 cp --acl public-read ./out.zip "s3://quilt-lambda-$primary_region/$s3_key"
-
-            for region in $regions
-            do
-                if [ "$region" != "$primary_region" ]
-                then
-                    echo "Copying to $region..."
-                    aws s3 cp --acl public-read "s3://quilt-lambda-$primary_region/$s3_key" "s3://quilt-lambda-$region/$s3_key" --region "$region" --source-region "$primary_region"
-                fi
-            done
-
-            echo "Deployed $s3_key"
+            s3_key="$(basename "$PWD")/${{ github.sha }}.zip"
+            ./lambdas/upload_zip.sh ./out.zip "$s3_key"
       - name: Configure AWS credentials from GovCloud account
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -76,25 +59,8 @@ jobs:
           aws-region: us-gov-east-1
       - name: Upload zips to GovCloud S3
         run: |
-            primary_region=us-gov-east-1
-            regions=$(aws ec2 describe-regions --query "Regions[].{Name:RegionName}" --output text)
-
-            lambda_name=$(basename "$(pwd)")
-            s3_key="$lambda_name/${{ github.sha }}.zip"
-
-            echo "Uploading to $primary_region..."
-            aws s3 cp --acl public-read ./out.zip "s3://quilt-lambda-$primary_region/$s3_key"
-
-            for region in $regions
-            do
-                if [ "$region" != "$primary_region" ]
-                then
-                    echo "Copying to $region..."
-                    aws s3 cp --acl public-read "s3://quilt-lambda-$primary_region/$s3_key" "s3://quilt-lambda-$region/$s3_key" --region "$region" --source-region "$primary_region"
-                fi
-            done
-
-            echo "Deployed $s3_key"
+            s3_key="$(basename "$PWD")/${{ github.sha }}.zip"
+            ./lambdas/upload_zip.sh ./out.zip "$s3_key"
 
   deploy-lambda-ecr:
     strategy:
diff --git a/lambdas/upload_zip.sh b/lambdas/upload_zip.sh
new file mode 100755
index 00000000000..7822efdff8f
--- /dev/null
+++ b/lambdas/upload_zip.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+error() {
+    echo $@ 2>&1
+    exit 1
+}
+
+[[ $# == 2 ]] || error "Usage: $0 zip_file s3_key"
+
+zip_file=$1
+s3_key=$2
+
+primary_region=$(aws configure get region)
+regions=$(aws ec2 describe-regions --query "Regions[].{Name:RegionName}" --output text)
+
+echo "Uploading to $primary_region..."
+aws s3 cp --acl public-read "$zip_file" --region "$primary_region" "s3://quilt-lambda-$primary_region/$s3_key"
+
+for region in $regions
+do
+    if [[ $region != $primary_region ]]
+    then
+        echo "Copying to $region..."
+        aws s3 cp --acl public-read \
+            "s3://quilt-lambda-$primary_region/$s3_key" --source-region "$primary_region" \
+            "s3://quilt-lambda-$region/$s3_key" --region "$region"
+    fi
+done
+