diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 3c588ada8..73923a854 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -59,3 +59,14 @@ jobs:
     - name: Build Linux AMD64
       run: |
         make embedded-cluster-linux-amd64 VERSION=dev-$SHORT_SHA
+        ./output/bin/embedded-cluster version metadata > metadata.json
+
+    - name: Cache files
+      env:
+        S3_BUCKET: "tf-infra-staging-emb-cluster-bin"
+        AWS_ACCESS_KEY_ID: ${{ secrets.INFRA_EMBEDDED_CLUSTER_UPLOAD_IAM_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.INFRA_EMBEDDED_CLUSTER_UPLOAD_IAM_SECRET }}
+        AWS_REGION: "us-east-1"
+        EC_VERSION: "dev-$SHORT_SHA"
+      run: |
+        ./scripts/cache-files.sh
diff --git a/.github/workflows/release-dev.yaml b/.github/workflows/release-dev.yaml
index d71863898..0c2d436ac 100644
--- a/.github/workflows/release-dev.yaml
+++ b/.github/workflows/release-dev.yaml
@@ -22,13 +22,16 @@ jobs:
           make embedded-cluster-linux-amd64
           tar -C output/bin -czvf embedded-cluster-linux-amd64.tgz embedded-cluster
           ./output/bin/embedded-cluster version metadata > metadata.json
+      - name: Get short commit hash
+        run: echo "SHORT_SHA=$(git rev-parse --short=7 HEAD)" >> $GITHUB_ENV
       - name: Cache files
+        env:
+          S3_BUCKET: "tf-staging-embedded-cluster-bin"
+          AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_UPLOAD_IAM_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.STAGING_EMBEDDED_CLUSTER_UPLOAD_IAM_SECRET }}
+          AWS_REGION: "us-east-1"
+          EC_VERSION: "staging-$SHORT_SHA"
         run: |
-          export AWS_REGION=us-east-1
-          export AWS_ACCESS_KEY_ID=TODO
-          export AWS_SECRET_ACCESS_KEY=TODO
-          export S3_BUCKET=tf-staging-embedded-cluster-bin
-          export EC_VERSION=development
           ./scripts/cache-files.sh
       - name: Publish development release
         uses: marvinpinto/action-automatic-releases@latest
diff --git a/.github/workflows/release-prod.yaml b/.github/workflows/release-prod.yaml
index a7311eec1..ac62e29b9 100644
--- a/.github/workflows/release-prod.yaml
+++ b/.github/workflows/release-prod.yaml
@@ -25,12 +25,14 @@ jobs:
           tar -C output/bin -czvf embedded-cluster-linux-amd64.tgz embedded-cluster
           ./output/bin/embedded-cluster version metadata > metadata.json
       - name: Cache files
+      - name: Cache files
+        env:
+          S3_BUCKET: "tf-embedded-cluster-binaries"
+          AWS_ACCESS_KEY_ID: ${{ secrets.PROD_EMBEDDED_CLUSTER_UPLOAD_IAM_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.PROD_EMBEDDED_CLUSTER_UPLOAD_IAM_SECRET }}
+          AWS_REGION: "us-east-1"
+          EC_VERSION: "$TAG_NAME"
         run: |
-          export AWS_REGION=us-east-1
-          export AWS_ACCESS_KEY_ID=TODO
-          export AWS_SECRET_ACCESS_KEY=TODO
-          export S3_BUCKET=tf-embedded-cluster-binaries
-          export EC_VERSION=$TAG_NAME
           ./scripts/cache-files.sh
       - name: Publish release
         uses: marvinpinto/action-automatic-releases@latest
diff --git a/scripts/cache-files.sh b/scripts/cache-files.sh
index f25e954b4..882740804 100644
--- a/scripts/cache-files.sh
+++ b/scripts/cache-files.sh
@@ -74,9 +74,9 @@ function metadata() {
     fi
 
     # check if a file 'metadata.json' exists in the directory
-    # if it does, upload it as metadata-${ec_version}.json
+    # if it does, upload it as metadata/${ec_version}.json
     if [ -f metadata.json ]; then
-        retry 3 aws s3 cp metadata.json "s3://${S3_BUCKET}/metadata-${EC_VERSION}.json"
+        retry 3 aws s3 cp metadata.json "s3://${S3_BUCKET}/metadata/${EC_VERSION}.json"
     else
         echo "metadata.json not found, skipping upload"
     fi