diff --git a/configuration.c b/configuration.c
index 1a9917de6ebe..5d76f2481137 100644
--- a/configuration.c
+++ b/configuration.c
@@ -1619,10 +1619,17 @@ static struct config_array_setting *populate_settings_array(
 
 #ifdef HAVE_NETWORKING
    SETTING_ARRAY("netplay_mitm_server",          settings->arrays.netplay_mitm_server, false, NULL, true);
+#ifdef HAVE_CLOUDSYNC
    SETTING_ARRAY("webdav_url",                   settings->arrays.webdav_url, false, NULL, true);
    SETTING_ARRAY("webdav_username",              settings->arrays.webdav_username, false, NULL, true);
    SETTING_ARRAY("webdav_password",              settings->arrays.webdav_password, false, NULL, true);
    SETTING_ARRAY("google_drive_refresh_token",   settings->arrays.google_drive_refresh_token, false, NULL, true);
+#ifdef HAVE_S3
+   SETTING_ARRAY("s3_url",                       settings->arrays.s3_url, false, NULL, true);
+   SETTING_ARRAY("access_key_id",                settings->arrays.access_key_id, false, NULL, true);
+   SETTING_ARRAY("secret_access_key",            settings->arrays.secret_access_key, false, NULL, true);
+#endif
+#endif
    SETTING_ARRAY("youtube_stream_key",           settings->arrays.youtube_stream_key, true, NULL, true);
    SETTING_ARRAY("twitch_stream_key",            settings->arrays.twitch_stream_key, true, NULL, true);
    SETTING_ARRAY("facebook_stream_key",          settings->arrays.facebook_stream_key, true, NULL, true);
diff --git a/configuration.h b/configuration.h
index 3225a2aae2ef..82fbc33d826c 100644
--- a/configuration.h
+++ b/configuration.h
@@ -541,10 +541,19 @@ typedef struct settings
       char audio_device[NAME_MAX_LENGTH];
       char camera_device[NAME_MAX_LENGTH];
       char netplay_mitm_server[NAME_MAX_LENGTH];
+#ifdef HAVE_NETWORKING
+#ifdef HAVE_CLOUDSYNC
       char webdav_url[NAME_MAX_LENGTH];
       char webdav_username[NAME_MAX_LENGTH];
       char webdav_password[NAME_MAX_LENGTH];
       char google_drive_refresh_token[2048];
+#ifdef HAVE_S3
+      char s3_url[NAME_MAX_LENGTH];
+      char access_key_id[128];
+      char secret_access_key[186]; /* TODO/RESEARCH - check size, ex https://github.com/winscp/winscp/pull/15/files */
+#endif
+#endif
+#endif
 
       char crt_switch_timings[NAME_MAX_LENGTH];
       char input_reserved_devices[MAX_USERS][NAME_MAX_LENGTH];
diff --git a/griffin/griffin.c b/griffin/griffin.c
index 8b84bc0ad3d6..2a3479835e2b 100644
--- a/griffin/griffin.c
+++ b/griffin/griffin.c
@@ -1721,6 +1721,9 @@ CLOUD SYNC
 #ifdef HAVE_SMBCLIENT
 #include "../network/cloud_sync/smb.c"
 #endif
+#ifdef HAVE_S3
+#include "../network/cloud_sync/s3.c"
+#endif
 #endif
 
 /*============================================================
diff --git a/intl/msg_hash_lbl.h b/intl/msg_hash_lbl.h
index 383fcb3370f3..b3b0b32db9c2 100644
--- a/intl/msg_hash_lbl.h
+++ b/intl/msg_hash_lbl.h
@@ -3550,6 +3550,18 @@ MSG_HASH(
    MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,
    "cloud_sync_password"
    )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+   "cloud_sync_access_key_id"
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "cloud_sync_secret_access_key"
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,
+   "cloud_sync_s3_url"
+   )
 MSG_HASH(
    MENU_ENUM_LABEL_SCAN_DIRECTORY,
    "scan_directory"
diff --git a/intl/msg_hash_us.h b/intl/msg_hash_us.h
index 81cde5d6cec4..ad20e4843531 100644
--- a/intl/msg_hash_us.h
+++ b/intl/msg_hash_us.h
@@ -1158,6 +1158,30 @@ MSG_HASH(
    MENU_ENUM_SUBLABEL_CLOUD_SYNC_PASSWORD,
    "Your password for your cloud storage account."
    )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_ACCESS_KEY_ID,
+   "Access Key ID"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+   "Your access key ID for your cloud storage account."
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "Secret Access Key"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "Your secret access key for your cloud storage account."
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_S3_URL,
+   "S3 URL"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_S3_URL,
+   "Your S3 endpoint URL for cloud storage."
+   )
 MSG_HASH(
    MENU_ENUM_LABEL_VALUE_LOGGING_SETTINGS,
    "Logging"
diff --git a/libretro-common/include/net/net_http.h b/libretro-common/include/net/net_http.h
index 7b68ddd6304d..a1e5c18792fe 100644
--- a/libretro-common/include/net/net_http.h
+++ b/libretro-common/include/net/net_http.h
@@ -34,6 +34,43 @@ RETRO_BEGIN_DECLS
 struct http_t;
 struct http_connection_t;
 
+typedef enum net_http_phase
+{
+   NET_HTTP_PHASE_CONNECT = 0,
+   NET_HTTP_PHASE_SEND,
+   NET_HTTP_PHASE_RECV_HEADER,
+   NET_HTTP_PHASE_RECV_BODY,
+   NET_HTTP_PHASE_REDIRECT,
+   NET_HTTP_PHASE_DONE,
+   NET_HTTP_PHASE_ERROR
+} net_http_phase_t;
+
+const char *net_http_phase_to_string(net_http_phase_t phase);
+
+/* Caller-facing, point-in-time HTTP transport snapshot.
+ *
+ * Notes:
+ * - Some fields intentionally mirror live http_t state (e.g. status/fd/err)
+ *   so callers can log a single self-contained payload without issuing
+ *   additional net_http_* calls.
+ * - Snapshot data is safe to copy and retain after transfer completion,
+ *   unlike the opaque internal state which may be freed. */
+typedef struct net_http_debug_state
+{
+   int fd;
+   int status;
+   int last_errno;
+   int64_t last_io_len;
+   size_t progress;
+   size_t total;
+   unsigned redirects;
+   bool ssl;
+   bool connected;
+   bool request_sent;
+   bool err;
+   net_http_phase_t phase;
+} net_http_debug_state_t;
+
 struct http_connection_t *net_http_connection_new(const char *url, const char *method, const char *data);
 
 /**
@@ -96,6 +133,12 @@ int net_http_status(struct http_t *state);
  **/
 bool net_http_error(struct http_t *state);
 
+/* Copies the current transport snapshot into @out.
+ *
+ * Returns false if inputs are invalid; true on success.
+ * The returned snapshot is independent from internal http_t lifetime. */
+bool net_http_get_debug_state(struct http_t *state, net_http_debug_state_t *out);
+
 /**
  * net_http_headers:
  *
@@ -106,6 +149,7 @@ bool net_http_error(struct http_t *state);
  * If the status is not 20x and accept_error is false, it returns NULL.
  **/
 struct string_list *net_http_headers(struct http_t *state);
+struct string_list *net_http_headers_ex(struct http_t *state, bool accept_error);
 
 /**
  * net_http_data:
diff --git a/libretro-common/net/net_http.c b/libretro-common/net/net_http.c
index c43c238afedf..3e8e956b3147 100644
--- a/libretro-common/net/net_http.c
+++ b/libretro-common/net/net_http.c
@@ -23,6 +23,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include <errno.h>
 
 #include <net/net_http.h>
 #include <net/net_compat.h>
@@ -115,6 +116,7 @@ struct http_t
 
    request_t request;
    response_t response;
+   net_http_debug_state_t debug_state;
 };
 
 struct http_connection_t
@@ -133,6 +135,58 @@ struct http_connection_t
    bool ssl;
 };
 
+const char *net_http_phase_to_string(net_http_phase_t phase)
+{
+   switch (phase)
+   {
+      case NET_HTTP_PHASE_CONNECT:
+         return "connect";
+      case NET_HTTP_PHASE_SEND:
+         return "send";
+      case NET_HTTP_PHASE_RECV_HEADER:
+         return "recv_header";
+      case NET_HTTP_PHASE_RECV_BODY:
+         return "recv_body";
+      case NET_HTTP_PHASE_REDIRECT:
+         return "redirect";
+      case NET_HTTP_PHASE_DONE:
+         return "done";
+      case NET_HTTP_PHASE_ERROR:
+         return "error";
+      default:
+         return "unknown";
+   }
+}
+
+static void net_http_debug_sync(struct http_t *state)
+{
+   if (!state)
+      return;
+
+   state->debug_state.ssl          = state->ssl;
+   state->debug_state.request_sent = state->request_sent;
+   state->debug_state.err          = state->err;
+   state->debug_state.status       = state->response.status;
+   state->debug_state.connected    = state->conn ? state->conn->connected : false;
+   state->debug_state.fd           = state->conn ? state->conn->fd : -1;
+}
+
+static void net_http_debug_set_phase(struct http_t *state, net_http_phase_t phase)
+{
+   if (!state)
+      return;
+   state->debug_state.phase = phase;
+}
+
+static void net_http_debug_set_io(struct http_t *state, ssize_t io_len)
+{
+   if (!state)
+      return;
+
+   state->debug_state.last_io_len = (int64_t)io_len;
+   state->debug_state.last_errno  = errno;
+}
+
 struct dns_cache_entry
 {
    char *domain;
@@ -849,6 +903,15 @@ struct http_t *net_http_new(struct http_connection_t *conn)
    state->response.buflen  = 64 * 1024;  /* Start with larger buffer to reduce reallocations */
    state->response.data    = (char*)malloc(state->response.buflen);
    state->response.headers = string_list_new();
+   state->debug_state.fd         = -1;
+   state->debug_state.status     = -1;
+   state->debug_state.last_errno = 0;
+   state->debug_state.last_io_len = -1;
+   state->debug_state.progress   = 0;
+   state->debug_state.total      = 0;
+   state->debug_state.redirects  = 0;
+   state->debug_state.phase      = NET_HTTP_PHASE_CONNECT;
+   net_http_debug_sync(state);
 
    return state;
 }
@@ -920,13 +983,25 @@ static bool net_http_new_socket(struct http_t *state)
          int fd;
          if (!entry->addr)
          {
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             UNLOCK_DNS_CACHE();
             return false;
          }
          addr = entry->addr;
          fd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
          if (fd >= 0)
+         {
             state->conn = net_http_conn_pool_add(state->request.domain, state->request.port, fd, state->ssl);
+            net_http_debug_sync(state);
+         }
+         else
+         {
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
+         }
          /* still waiting on thread */
          UNLOCK_DNS_CACHE();
          return (fd >= 0);
@@ -969,12 +1044,19 @@ static bool net_http_connect(struct http_t *state)
    if (state->ssl)
    {
       if (!conn)
+      {
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          return false;
-
+      }
       for (next_addr = addr; conn->fd >= 0; conn->fd = socket_next((void**)&next_addr))
       {
          if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, state->request.domain)))
          {
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             socket_close(conn->fd);
             break;
          }
@@ -992,6 +1074,9 @@ static bool net_http_connect(struct http_t *state)
 
          if (ssl_socket_connect(conn->ssl_ctx, next_addr, timeout, true) < 0)
          {
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             ssl_socket_close(conn->ssl_ctx);
             ssl_socket_free(conn->ssl_ctx);
             conn->ssl_ctx = NULL;
@@ -999,6 +1084,8 @@ static bool net_http_connect(struct http_t *state)
          else
          {
             conn->connected = true;
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
+            net_http_debug_sync(state);
             return true;
          }
       }
@@ -1016,9 +1103,14 @@ static bool net_http_connect(struct http_t *state)
          if (socket_connect_with_timeout(conn->fd, next_addr, 5000))
          {
             conn->connected = true;
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
+            net_http_debug_sync(state);
             return true;
          }
 
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          socket_close(conn->fd);
       }
       conn->fd    = -1; /* already closed */
@@ -1039,14 +1131,24 @@ static void net_http_send_str(
    {
       if (!ssl_socket_send_all_blocking(
                   state->conn->ssl_ctx, text, text_size, true))
+      {
          state->err = true;
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
+      }
    }
    else
 #endif
    {
       if (!socket_send_all_blocking(
                   state->conn->fd, text, text_size, true))
+      {
          state->err = true;
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
+      }
    }
 }
 
@@ -1097,9 +1199,14 @@ static bool net_http_send_request(struct http_t *state)
       size_t _len, len;
       char *len_str = NULL;
 
-      if (!request->postdata && !string_is_equal(request->method, "PUT"))
+      if (!request->postdata &&
+            !string_is_equal(request->method, "PUT") &&
+            request->contentlength > 0)
       {
          state->err = true;
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          return true;
       }
 
@@ -1143,6 +1250,8 @@ static bool net_http_send_request(struct http_t *state)
             request->contentlength);
 
    state->request_sent = true;
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_HEADER);
+   net_http_debug_sync(state);
    return state->err;
 }
 
@@ -1186,10 +1295,13 @@ static ssize_t net_http_receive_header(struct http_t *state, ssize_t len)
          {
             response->part = P_DONE;
             state->err     = true;
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
             return -1;
          }
          response->status = (int)strtoul(response->data
                + STRLEN_CONST("HTTP/1.1 "), NULL, 10);
+      net_http_debug_sync(state);
          response->part   = P_HEADER;
       }
       else
@@ -1404,6 +1516,9 @@ static bool net_http_redirect(struct http_t *state, const char *location)
    /* after this, assume location is invalid */
    string_list_deinitialize(state->response.headers);
    string_list_initialize(state->response.headers);
+   state->debug_state.redirects++;
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_REDIRECT);
+   net_http_debug_sync(state);
    /* keep going */
    return false;
 }
@@ -1422,26 +1537,43 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
    if (!state || state->err)
       return true;
 
+   net_http_debug_sync(state);
+
    if (!state->conn)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_CONNECT);
       state->conn = net_http_conn_pool_find(state->request.domain, state->request.port);
       if (!state->conn)
       {
          if (!net_http_new_socket(state))
             state->err = true;
+         if (state->err)
+         {
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
+         }
          return state->err;
       }
+      net_http_debug_sync(state);
    }
 
    if (!state->conn->connected)
    {
       if (!net_http_connect(state))
          state->err = true;
+      if (state->err)
+      {
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
+      }
       return state->err;
    }
 
    if (!state->request_sent)
+   {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
       return net_http_send_request(state);
+   }
 
    response = (struct response*)&state->response;
 
@@ -1455,36 +1587,49 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
       _len = socket_receive_all_nonblocking(state->conn->fd, &state->err,
             (uint8_t*)response->data + response->pos,
             response->buflen - response->pos);
+   net_http_debug_set_io(state, _len);
 
    if (response->part < P_BODY)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_HEADER);
       if (_len < 0 || state->err)
       {
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
          response->part   = P_DONE;
          response->status = -1;
+         net_http_debug_sync(state);
          return true;
       }
       _len = net_http_receive_header(state, _len);
+      net_http_debug_set_io(state, _len);
    }
 
    if (response->part >= P_BODY && response->part < P_DONE)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_BODY);
       if (!net_http_receive_body(state, _len))
       {
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
          response->part   = P_DONE;
          response->status = -1;
+         net_http_debug_sync(state);
          return true;
       }
    }
 
    if (progress)
+   {
       *progress = response->pos;
+      state->debug_state.progress = *progress;
+   }
+   else
+      state->debug_state.progress = response->pos;
 
    if (total)
    {
@@ -1492,10 +1637,16 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
          *total = response->len;
       else
          *total = 0;
+      state->debug_state.total = *total;
    }
+   else
+      state->debug_state.total = (response->bodytype == T_LEN) ? response->len : 0;
 
    if (response->part != P_DONE)
+   {
+      net_http_debug_sync(state);
       return false;
+   }
 
    for (_len = 0; (size_t)_len < response->headers->size; _len++)
    {
@@ -1520,6 +1671,8 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
       }
    }
 
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_DONE);
+   net_http_debug_sync(state);
    return true;
 }
 
@@ -1548,13 +1701,20 @@ int net_http_status(struct http_t *state)
  * caller of net_http_new; it is not freed by net_http_delete().
  * If the status is not 20x and accept_err is false, it returns NULL.
  **/
-struct string_list *net_http_headers(struct http_t *state)
+struct string_list *net_http_headers_ex(struct http_t *state, bool accept_err)
 {
-   if (!state || !state->err)
+   if (!state)
+      return NULL;
+   if (!accept_err && !state->err)
       return NULL;
    return state->response.headers;
 }
 
+struct string_list *net_http_headers(struct http_t *state)
+{
+   return net_http_headers_ex(state, false);
+}
+
 /**
  * net_http_data:
  *
@@ -1582,6 +1742,16 @@ uint8_t* net_http_data(struct http_t *state, size_t* len, bool accept_err)
    return (uint8_t*)state->response.data;
 }
 
+bool net_http_get_debug_state(struct http_t *state, net_http_debug_state_t *out)
+{
+   if (!state || !out)
+      return false;
+
+   net_http_debug_sync(state);
+   *out = state->debug_state;
+   return true;
+}
+
 /**
  * net_http_delete:
  *
diff --git a/menu/cbs/menu_cbs_sublabel.c b/menu/cbs/menu_cbs_sublabel.c
index 4904e423d9a1..de2d9d2cdd08 100644
--- a/menu/cbs/menu_cbs_sublabel.c
+++ b/menu/cbs/menu_cbs_sublabel.c
@@ -270,8 +270,11 @@ DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_sync_thumbs,        MENU_
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_sync_system,        MENU_ENUM_SUBLABEL_CLOUD_SYNC_SYNC_SYSTEM)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_driver,             MENU_ENUM_SUBLABEL_CLOUD_SYNC_DRIVER)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_url,                MENU_ENUM_SUBLABEL_CLOUD_SYNC_URL)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_s3_url,             MENU_ENUM_SUBLABEL_CLOUD_SYNC_S3_URL)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_username,           MENU_ENUM_SUBLABEL_CLOUD_SYNC_USERNAME)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_password,           MENU_ENUM_SUBLABEL_CLOUD_SYNC_PASSWORD)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_access_key_id,      MENU_ENUM_SUBLABEL_CLOUD_SYNC_ACCESS_KEY_ID)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_secret_access_key,  MENU_ENUM_SUBLABEL_CLOUD_SYNC_SECRET_ACCESS_KEY)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_logging_settings_list,         MENU_ENUM_SUBLABEL_LOGGING_SETTINGS)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_user_interface_settings_list,  MENU_ENUM_SUBLABEL_USER_INTERFACE_SETTINGS)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_ai_service_settings_list,  MENU_ENUM_SUBLABEL_AI_SERVICE_SETTINGS)
@@ -5254,12 +5257,21 @@ int menu_cbs_init_bind_sublabel(menu_file_list_cbs_t *cbs,
          case MENU_ENUM_LABEL_CLOUD_SYNC_URL:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_url);
             break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL:
+            BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_s3_url);
+            break;
          case MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_username);
             break;
          case MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_password);
             break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID:
+           BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_access_key_id);
+           break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY:
+           BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_secret_access_key);
+           break;
          case MENU_ENUM_LABEL_LOGGING_SETTINGS:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_logging_settings_list);
             break;
diff --git a/menu/menu_displaylist.c b/menu/menu_displaylist.c
index 09730a024165..afdba82c304a 100644
--- a/menu/menu_displaylist.c
+++ b/menu/menu_displaylist.c
@@ -10364,7 +10364,7 @@ unsigned menu_displaylist_build_list(
                            MENU_ENUM_LABEL_VIDEO_HDR_SCANLINES,
                            PARSE_ONLY_BOOL, false) == 0)
                      count++;
-                     
+
                   if(settings->bools.video_hdr_scanlines)
                   {
                      if (MENU_DISPLAYLIST_PARSE_SETTINGS_ENUM(list,
@@ -11345,22 +11345,54 @@ unsigned menu_displaylist_build_list(
       case DISPLAYLIST_CLOUD_SYNC_SETTINGS_LIST:
          {
             menu_displaylist_build_info_selective_t build_list[] = {
-               {MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE,       PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE,    PARSE_ONLY_UINT,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES,   PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS, PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER,       PARSE_ONLY_STRING_OPTIONS, true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_URL,          PARSE_ONLY_STRING,         false},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME,     PARSE_ONLY_STRING,         false},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,     PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE,             PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE,          PARSE_ONLY_UINT,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES,         PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS,       PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER,             PARSE_ONLY_STRING_OPTIONS, true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_URL,                PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME,           PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,           PARSE_ONLY_STRING,         false},
+#ifdef HAVE_S3
+               {MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,             PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,      PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,  PARSE_ONLY_STRING,         false},
+#endif
             };
 
-            if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav"))
-               for (i = 0; i < ARRAY_SIZE(build_list); i++)
-                  build_list[i].checked = true;
+            for (i = 0; i < ARRAY_SIZE(build_list); i++)
+               switch(build_list[i].enum_idx)
+                  {
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav")
+                        || string_is_equal(settings->arrays.cloud_sync_driver, "s3"))
+                       build_list[i].checked = true;
+                     break;
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_URL:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav"))
+                        build_list[i].checked = true;
+                     break;
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "s3"))
+                        build_list[i].checked = true;
+                     break;
+                  default:
+                     break;
+                  }
 
             for (i = 0; i < ARRAY_SIZE(build_list); i++)
             {
diff --git a/menu/menu_setting.c b/menu/menu_setting.c
index 22efacec5d84..4336fb2a3812 100644
--- a/menu/menu_setting.c
+++ b/menu/menu_setting.c
@@ -12282,6 +12282,58 @@ static bool setting_append_list(
          (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_PASSWORD_LINE_EDIT;
          (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
 
+#ifdef HAVE_S3
+         /* AWS */
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.s3_url,
+               sizeof(settings->arrays.s3_url),
+               MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_S3_URL,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_STRING_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.access_key_id,
+               sizeof(settings->arrays.access_key_id),
+               MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_ACCESS_KEY_ID,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_STRING_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.secret_access_key,
+               sizeof(settings->arrays.secret_access_key),
+               MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_SECRET_ACCESS_KEY,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         (*list)[list_info->index - 1].get_string_representation =
+            &setting_get_string_representation_password;
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_PASSWORD_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+#endif
          END_SUB_GROUP(list, list_info, parent_group);
          END_GROUP(list, list_info, parent_group);
 #endif
diff --git a/msg_hash.h b/msg_hash.h
index e9db968da693..05206a60cb70 100644
--- a/msg_hash.h
+++ b/msg_hash.h
@@ -1536,7 +1536,7 @@ enum msg_hash_enums
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_RGB,
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_RBG,
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_BGR,
-   
+
    MENU_LBL_H(PARENT_DIRECTORY),
    MENU_LBL_H(FILE_BROWSER_OPEN_UWP_PERMISSIONS),
    MENU_LABEL(FILE_BROWSER_OPEN_PICKER),
@@ -3212,6 +3212,9 @@ enum msg_hash_enums
    MENU_LABEL(CLOUD_SYNC_SYNC_NOW),
    MENU_LABEL(CLOUD_SYNC_RESOLVE_KEEP_LOCAL),
    MENU_LABEL(CLOUD_SYNC_RESOLVE_KEEP_SERVER),
+   MENU_LABEL(CLOUD_SYNC_S3_URL),
+   MENU_LABEL(CLOUD_SYNC_ACCESS_KEY_ID),
+   MENU_LABEL(CLOUD_SYNC_SECRET_ACCESS_KEY),
    MENU_LABEL(RECORDING_SETTINGS),
    MENU_LABEL(OVERLAY_SETTINGS),
    MENU_LABEL(REWIND_SETTINGS),
diff --git a/network/cloud_sync/google_drive.c b/network/cloud_sync/google_drive.c
index 54c10e2f86bc..bc4843e44a4d 100644
--- a/network/cloud_sync/google_drive.c
+++ b/network/cloud_sync/google_drive.c
@@ -1356,7 +1356,7 @@ static void gdrive_do_patch(gdrive_cb_state_t *cb_st)
          cb_st->path, (long long)len);
    task_push_http_transfer_with_content(url, "PATCH",
          buf, (size_t)len, "application/octet-stream",
-         true, headers, gdrive_upload_cb, cb_st);
+         true, false, headers, gdrive_upload_cb, cb_st);
    free(buf);
    free(headers);
 }
diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
new file mode 100644
index 000000000000..6e0a8034b502
--- /dev/null
+++ b/network/cloud_sync/s3.c
@@ -0,0 +1,2103 @@
+/*  RetroArch - A frontend for libretro.
+ *
+ *  RetroArch is free software: you can redistribute it and/or modify it under the terms
+ *  of the GNU General Public License as published by the Free Software Found-
+ *  ation, either version 3 of the License, or (at your option) any later version.
+ *
+ *  RetroArch is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+ *  without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ *  PURPOSE.  See the GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along with RetroArch.
+ *  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <encodings/base64.h>
+#include <lrc_hash.h>
+#include <string/stdstring.h>
+#include <time/rtime.h>
+#include <formats/rjson.h>
+#include <retro_miscellaneous.h>
+
+#include "../cloud_sync_driver.h"
+#include "../../retroarch.h"
+#include "../../tasks/tasks_internal.h"
+#include "../../verbosity.h"
+
+#define S3_PFX "[S3] "
+
+/* S3 multipart constants (AWS): 5 MiB min part size, 5 GiB max part size.
+ * The nominal multipart threshold below is a local policy trigger, not an S3 limit. */
+#define S3_MULTIPART_MIN_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL)
+#define S3_MULTIPART_MAX_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL * 1024ULL)
+#define S3_MAX_PARTS 10000
+#define S3_EMPTY_PAYLOAD_SHA256 "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+#define S3_SIGNATURE_VERSION "AWS4-HMAC-SHA256"
+#define S3_SERVICE "s3"
+
+#if defined(_3DS) || defined(VITA) || defined(PSP) || defined(PS2) || defined(WIIU) || defined(GEKKO)
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (16ULL * 1024ULL * 1024ULL)
+#elif defined(HAVE_LIBNX)
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (32ULL * 1024ULL * 1024ULL)
+#else
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (64ULL * 1024ULL * 1024ULL)
+#endif
+
+typedef struct
+{
+   char path[PATH_MAX_LENGTH];
+   char file[PATH_MAX_LENGTH];
+   cloud_sync_complete_handler_t cb;
+   void *user_data;
+   RFILE *rfile;
+} s3_cb_state_t;
+
+typedef struct
+{
+   char url[PATH_MAX_LENGTH];
+   char bucket[NAME_MAX_LENGTH];
+   char region[NAME_MAX_LENGTH];
+   char host[NAME_MAX_LENGTH];
+   char access_key_id[128];
+   char secret_access_key[186];
+   bool connected;
+} s3_state_t;
+
+typedef struct
+{
+   s3_cb_state_t *cb_state;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   char *file_data;
+   size_t file_size;
+   size_t part_size;
+   size_t part_count;
+   size_t current_part;
+   char *upload_id;
+   char **part_etags;
+   bool aborting;
+} s3_multipart_state_t;
+
+static s3_state_t s3_driver_st = {0};
+
+s3_state_t *s3_state_get_ptr(void)
+{
+   return &s3_driver_st;
+}
+
+static size_t s3_get_multipart_nominal_threshold_bytes(void)
+{
+   size_t threshold = (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
+   if (threshold < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+      threshold = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   if (threshold > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+      threshold = (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+   return threshold;
+}
+
+static bool s3_calculate_multipart_plan(size_t file_size, size_t *out_part_size, size_t *out_part_count)
+{
+   size_t part_size  = s3_get_multipart_nominal_threshold_bytes();
+   size_t part_count = 0;
+
+   if (!out_part_size || !out_part_count || file_size == 0)
+      return false;
+
+   if (part_size < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+      part_size = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   if (part_size > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+      part_size = (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+
+   part_count = (file_size + part_size - 1) / part_size;
+
+   if (part_count > S3_MAX_PARTS)
+   {
+      part_size = (file_size + S3_MAX_PARTS - 1) / S3_MAX_PARTS;
+      if (part_size < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+         part_size = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+      if (part_size > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+         return false;
+
+      part_count = (file_size + part_size - 1) / part_size;
+      if (part_count > S3_MAX_PARTS)
+         return false;
+   }
+
+   *out_part_size  = part_size;
+   *out_part_count = part_count;
+   return true;
+}
+
+/* Parse S3 URL to extract bucket, region, and host. Supports both virtual-hosted
+ * and path-style layouts so providers can be normalized from one URL string. */
+static bool s3_parse_url(const char *url, char *bucket,  char *region,
+                         char *host, char *service)
+{
+   const char *scheme_sep    = NULL;
+   const char *authority     = NULL;
+   const char *authority_end = NULL;
+   const char *path_start    = NULL;
+   const char *first_dot     = NULL;
+   const char *second_dot    = NULL;
+   char first_label[NAME_MAX_LENGTH];
+   char first_path_seg[NAME_MAX_LENGTH];
+
+   (void)service;
+
+   if (!url || !bucket || !region || !host)
+      return false;
+
+   RARCH_DBG(S3_PFX "Parsing S3 URL: %s\n", url);
+
+   bucket[0] = '\0';
+   region[0] = '\0';
+   host[0]   = '\0';
+   first_label[0]    = '\0';
+   first_path_seg[0] = '\0';
+
+   scheme_sep = strstr(url, "://");
+   authority  = scheme_sep ? scheme_sep + 3 : url;
+   if (string_is_empty(authority))
+      return false;
+
+   authority_end = strchr(authority, '/');
+   if (!authority_end)
+      authority_end = authority + strlen(authority);
+
+   if (authority_end > authority)
+   {
+      size_t host_len = authority_end - authority;
+      if (host_len >= NAME_MAX_LENGTH)
+         host_len = NAME_MAX_LENGTH - 1;
+      strlcpy(host, authority, host_len + 1);
+   }
+
+   if (string_is_empty(host))
+      return false;
+
+   if (*authority_end == '/')
+      path_start = authority_end + 1;
+
+   /* Capture first host label and first path segment for provider-specific rules. */
+   first_dot = strchr(host, '.');
+   if (first_dot)
+   {
+      size_t first_label_len = first_dot - host;
+      if (first_label_len > 0 && first_label_len < NAME_MAX_LENGTH)
+         strlcpy(first_label, host, first_label_len + 1);
+   }
+
+   if (path_start && *path_start)
+   {
+      const char *path_seg_end = strchr(path_start, '/');
+      size_t path_seg_len      = path_seg_end ? (size_t)(path_seg_end - path_start) : strlen(path_start);
+      if (path_seg_len > 0 && path_seg_len < NAME_MAX_LENGTH)
+         strlcpy(first_path_seg, path_start, path_seg_len + 1);
+   }
+
+   if (strstr(host, ".cloudflarestorage.com"))
+   {
+      const char *r2_suffix = ".r2.cloudflarestorage.com";
+      const char *r2_pos    = strstr(host, r2_suffix);
+
+      RARCH_LOG(S3_PFX "Detected Cloudflare R2 format\n");
+
+      if (r2_pos)
+      {
+         /* Cloudflare R2 supports both:
+          * - <bucket>.<accountid>.r2.cloudflarestorage.com
+          * - <accountid>.r2.cloudflarestorage.com/<bucket>/... */
+         const char *prefix_start = host;
+         size_t prefix_len         = (size_t)(r2_pos - prefix_start);
+
+         if (prefix_len > 0)
+         {
+            const char *prefix_dot = strchr(prefix_start, '.');
+
+            /* If there are two labels before ".r2..." then first label is bucket. */
+            if (prefix_dot && prefix_dot < r2_pos)
+            {
+               size_t bucket_len = (size_t)(prefix_dot - prefix_start);
+               if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+               {
+                  RARCH_LOG(S3_PFX "Cloudflare R2 style: virtual-hosted\n");
+                  strlcpy(bucket, prefix_start, bucket_len + 1);
+               }
+            }
+         }
+
+         /* Path-style endpoint (accountid.r2...) carries bucket in first path segment. */
+         if (string_is_empty(bucket) && !string_is_empty(first_path_seg))
+         {
+            RARCH_LOG(S3_PFX "Cloudflare R2 style: path-style\n");
+            strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+         }
+      }
+      else if (!string_is_empty(first_label))
+      {
+         /* Compatibility fallback for other cloudflarestorage host variants. */
+         RARCH_LOG(S3_PFX "Cloudflare R2 style: fallback-host-label\n");
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
+      }
+
+      /* Cloudflare R2 uses region "auto" for AWS SigV4. */
+      strlcpy(region, "auto", NAME_MAX_LENGTH);
+   }
+   else if (strstr(host, ".amazonaws.com"))
+   {
+      const char *s3pos = strstr(host, ".s3.");
+      const char *s3dash = strstr(host, ".s3-");
+      const char *s3accelerate = strstr(host, ".s3-accelerate.");
+      const char *s3acceleration = strstr(host, ".s3-acceleration.");
+      const char *host_start = host;
+
+      RARCH_LOG(S3_PFX "Detected AWS S3 format\n");
+
+      if (s3accelerate || s3acceleration)
+      {
+         const char *accel_pos = s3accelerate ? s3accelerate : s3acceleration;
+         size_t bucket_len = accel_pos - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+
+         /* Transfer acceleration endpoints do not encode bucket region in hostname.
+          * Keep fallback-compatible behavior by using us-east-1 here. */
+         strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
+      }
+      else if (s3pos)
+      {
+         size_t bucket_len = s3pos - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+         s3pos += 4; /* skip ".s3." */
+         second_dot = strchr(s3pos, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3pos;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3pos, region_len + 1);
+         }
+      }
+      else if (s3dash)
+      {
+         size_t bucket_len = s3dash - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+         s3dash += 4; /* skip ".s3-" */
+         second_dot = strchr(s3dash, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3dash;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3dash, region_len + 1);
+         }
+      }
+      else
+      {
+         /* Path-style fallback: s3.<region>.amazonaws.com/<bucket>/... */
+         if (!string_is_empty(first_path_seg))
+            strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      }
+   }
+   else if (strstr(host, ".backblazeb2.com"))
+   {
+      const char *s3pos = strstr(host, ".s3.");
+      bool b2_path_style_host = false;
+
+      RARCH_LOG(S3_PFX "Detected Backblaze B2 format\n");
+
+      /* Backblaze B2 path-style host: s3.<region>.backblazeb2.com/<bucket>/... */
+      if (string_starts_with_case_insensitive(host, "s3."))
+      {
+         const char *region_start = host + 3; /* skip "s3." */
+         second_dot = strchr(region_start, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - region_start;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+            {
+               strlcpy(region, region_start, region_len + 1);
+               b2_path_style_host = true;
+            }
+         }
+      }
+
+      if (s3pos && !b2_path_style_host)
+      {
+         RARCH_LOG(S3_PFX "Backblaze B2 style: virtual-hosted\n");
+         size_t bucket_len = s3pos - host;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host, bucket_len + 1);
+         s3pos += 4; /* skip ".s3." */
+         second_dot = strchr(s3pos, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3pos;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3pos, region_len + 1);
+         }
+      }
+      else if (!string_is_empty(first_path_seg))
+      {
+         RARCH_LOG(S3_PFX "Backblaze B2 style: path-style\n");
+         strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      }
+   }
+   else if (strstr(host, ".digitaloceanspaces.com") || strstr(host, ".linodeobjects.com"))
+   {
+      if (!string_is_empty(first_label))
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
+      if (first_dot)
+      {
+         const char *region_start = first_dot + 1;
+         second_dot = strchr(region_start, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - region_start;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, region_start, region_len + 1);
+         }
+      }
+   }
+   else
+   {
+      /* Generic fallback:
+       * - virtual-host: bucket.endpoint
+       * - path-style: endpoint/bucket */
+      if (!string_is_empty(first_path_seg))
+         strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      else if (!string_is_empty(first_label))
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
+   }
+
+   if (string_is_empty(region))
+      strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
+
+   if (string_is_empty(bucket))
+      RARCH_WARN(S3_PFX "Could not extract bucket from URL: %s\n", url);
+
+   RARCH_LOG(S3_PFX "Extracted bucket: %s, region: %s, host: %s\n",
+             string_is_empty(bucket) ? "(none)" : bucket, region, host);
+
+   return !string_is_empty(host) && !string_is_empty(bucket);
+}
+
+/* Calculate SHA256 hash */
+static char* s3_sha256_hash(const char *data, size_t len)
+{
+   char *hash = malloc(65);
+   if (!hash)
+      return NULL;
+
+   sha256_hash(hash, (const uint8_t*)data, len);
+   hash[64] = '\0';
+   return hash;
+}
+
+/* URL encode a string according to RFC 3986 */
+static char* s3_url_encode(const char *input)
+{
+   size_t input_len = strlen(input);
+   size_t output_pos = 0;
+
+   /* Worst case: every char needs encoding */
+   char *output = malloc(input_len * 3 + 1); 
+   
+   size_t i;
+   
+   if (!output)
+      return NULL;
+   
+   if (!input)
+      return NULL;
+
+
+   for (i = 0; i < input_len; i++)
+   {
+      unsigned char c = (unsigned char)input[i];
+
+      /* RFC 3986 unreserved characters: A-Z, a-z, 0-9, -, ., _, ~ */
+      /* Path delimiters that should not be encoded: / */
+      /* Query parameter delimiters that should not be encoded: &, =, ? */
+      if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || 
+          c == '~' || c == '/' || c == '&' || c == '=' || c == '?')
+      {
+         output[output_pos++] = c;
+      }
+      else
+      {
+         /* Percent encode */
+         output[output_pos++] = '%';
+         output[output_pos++] = "0123456789ABCDEF"[c >> 4];
+         output[output_pos++] = "0123456789ABCDEF"[c & 0x0F];
+      }
+   }
+   output[output_pos] = '\0';
+   return output;
+}
+
+/* Trim whitespace from string */
+static char* s3_trim_string(const char *input)
+{
+   size_t len = strlen(input);
+   size_t start = 0;
+   size_t end = len;
+   size_t trimmed_len = 0;
+   char *trimmed = NULL;
+
+   if (!input)
+      return NULL;
+
+   /* Find start of non-whitespace */
+   while (start < len && (input[start] == ' ' || input[start] == '\t'))
+      start++;
+
+   /* Find end of non-whitespace */
+   while (end > start && (input[end-1] == ' ' || input[end-1] == '\t'))
+      end--;
+
+   /* Create trimmed string */
+   trimmed_len = end - start;
+   trimmed = malloc(trimmed_len + 1);
+   if (!trimmed)
+      return NULL;
+
+   memcpy(trimmed, input + start, trimmed_len);
+   trimmed[trimmed_len] = '\0';
+
+   return trimmed;
+}
+
+/* Canonicalize query string parameters */
+static char* s3_canonicalize_query_string(const char *query_string)
+{
+   if (!query_string || !*query_string)
+      return strdup("");
+
+   /* For now, return the query string as-is since most S3 operations don't use
+    * query parameters
+    * A full implementation would:
+    * 1. Split parameters by '&'
+    * 2. URL encode each parameter name and value
+    * 3. Sort parameters alphabetically by name
+    * 4. Join with '&'
+    */
+   return strdup(query_string);
+}
+
+/* Calculate HMAC-SHA256 and return binary result */
+static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const char *data, uint8_t *output)
+{
+   unsigned i       = 0;
+   char *inner_data = NULL;
+   size_t data_len  = strlen(data);
+
+   char inner_pad[64];
+   char outer_pad[64];
+   uint8_t key_hash[32];
+
+   char inner_hash_hex[65];
+   uint8_t inner_hash_bin[32];
+   char final_hash_hex[65];
+
+   /* Hash the key if it's longer than 64 bytes */
+   if (key_len > 64)
+   {
+      char temp_hash[65];/* Use a temporary buffer for the hash */
+      sha256_hash(temp_hash, (const uint8_t*)key, key_len);
+
+      /* Convert hex to binary */
+      for (i = 0; i < 32; i++)
+      {
+         char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
+         key_hash[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+      }
+      key = key_hash;
+      key_len = 32;
+   }
+   else
+   {
+   }
+
+   /* Pad the key to 64 bytes */
+   memset(outer_pad, 0, 64);
+   memset(inner_pad, 0, 64);
+   if (key_len <= 64)
+   {
+      memcpy(outer_pad, key, key_len);
+      memcpy(inner_pad, key, key_len);
+   }
+   else
+   {
+      /* Key is longer than 64 bytes, this shouldn't happen after hashing */
+      memcpy(outer_pad, key, 64);
+      memcpy(inner_pad, key, 64);
+   }
+
+   /* XOR with constants */
+   for (i = 0; i < 64; i++)
+   {
+      outer_pad[i] ^= 0x5c;
+      inner_pad[i] ^= 0x36;
+   }
+
+   /* Inner hash: H(K XOR 0x36, text) */
+   inner_data = malloc(64 + data_len);
+   if (!inner_data)
+      return NULL;
+
+   memcpy(inner_data, inner_pad, 64);
+   memcpy(inner_data + 64, data, data_len);
+
+   /* Hash and convert to binary */
+   sha256_hash(inner_hash_hex, (const uint8_t*)inner_data, 64 + data_len);
+
+   for (i = 0; i < 32; i++)
+   {
+      char hex_byte[3] = {inner_hash_hex[i*2], inner_hash_hex[i*2+1], 0};
+      inner_hash_bin[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+   }
+
+   /* Outer hash: H(K XOR 0x5c, inner_hash_bin) */
+   /* Ensure we have enough space for outer hash (64 + 32 = 96 bytes) */
+   if (64 + data_len < 96)
+   {
+      /* Reallocate if needed */
+      char *outer_data = realloc(inner_data, 96);
+      if (!outer_data)
+      {
+         free(inner_data);
+         return NULL;
+      }
+      inner_data = outer_data;
+   }
+
+   memcpy(inner_data, outer_pad, 64);
+   memcpy(inner_data + 64, inner_hash_bin, 32);
+
+   sha256_hash(final_hash_hex, (const uint8_t*)inner_data, 64 + 32);
+
+   /* Convert final result to binary */
+   for (i = 0; i < 32; i++)
+   {
+      char hex_byte[3] = {final_hash_hex[i*2], final_hash_hex[i*2+1], 0};
+      output[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+   }
+
+   /* Cleanup */
+   free(inner_data);
+
+   return output;
+}
+
+/* Calculate HMAC-SHA256 (legacy function for compatibility) */
+static char* s3_hmac_sha256(const char *key, const char *data, char *output)
+{
+   unsigned i;
+   char *hmac_hex = malloc(65);
+   uint8_t binary_key[64];
+   size_t key_len;
+   uint8_t result[32];
+
+   if (!hmac_hex)
+      return NULL;
+
+   key_len = strlen(key);
+
+   /* Convert key to binary */
+   if (key_len <= 64)
+   {
+      memset(binary_key, 0, 64);
+      memcpy(binary_key, key, key_len);
+   }
+   else
+   {
+      /* Hash the key if it's longer than 64 bytes */
+      char temp_hash[65];
+      sha256_hash(temp_hash, (const uint8_t*)key, key_len);
+      for (i = 0; i < 32; i++)
+      {
+         char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
+         binary_key[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+      }
+      key_len = 32;
+   }
+
+   if (!s3_hmac_sha256_bin(binary_key, key_len, data, result))
+   {
+      free(hmac_hex);
+      return NULL;
+   }
+
+   /* Convert binary result to hex */
+   for (i = 0; i < 32; i++)
+      snprintf(hmac_hex + 2 * i, 3, "%02x", (unsigned)result[i]);
+
+   hmac_hex[64] = '\0';
+   return hmac_hex;
+}
+
+/* Calculate AWS Signature Version 4 signature with proper key derivation */
+static char* s3_calculate_aws4_signature(const char *secret_key, const char *date,
+                                        const char *region, const char *service,
+                                        const char *string_to_sign)
+{
+   unsigned i;
+   char *signature;
+   char aws4_key[128];
+   uint8_t k_date[32];
+   uint8_t k_region[32];
+   uint8_t k_service[32];
+   uint8_t k_signing[32];
+   uint8_t final_signature[32];
+   char k_date_hex[65];
+   char k_region_hex[65];
+   char k_service_hex[65];
+
+   signature = malloc(65);
+   if (!signature)
+      return NULL;
+
+   /* Build AWS4 key string */
+   snprintf(aws4_key, sizeof(aws4_key), "AWS4%s", secret_key);
+
+   /* Derive keys step by step using binary HMAC throughout */
+   /* Step 1: DateKey = HMAC-SHA256("AWS4" + SecretAccessKey, Date) */
+   /* Note: aws4_key is a string, but HMAC treats it as byte data */
+   if (!s3_hmac_sha256_bin((uint8_t*)aws4_key, strlen(aws4_key), date, k_date))
+      goto error;
+
+   /* Debug: Show k_date */
+   for (i = 0; i < 32; i++)
+      snprintf(k_date_hex + 2 * i, 3, "%02x", (unsigned)k_date[i]);
+   k_date_hex[64] = '\0';
+   /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
+   if (!s3_hmac_sha256_bin(k_date, 32, region, k_region))
+      goto error;
+
+   /* Debug: Show k_region */
+   for (i = 0; i < 32; i++)
+      snprintf(k_region_hex + 2 * i, 3, "%02x", (unsigned)k_region[i]);
+   k_region_hex[64] = '\0';
+   /* Step 3: DateRegionServiceKey = HMAC-SHA256(DateRegionKey, Service) */
+   if (!s3_hmac_sha256_bin(k_region, 32, service, k_service))
+      goto error;
+
+   /* Debug: Show k_service */
+   for (i = 0; i < 32; i++)
+      snprintf(k_service_hex + 2 * i, 3, "%02x", (unsigned)k_service[i]);
+   k_service_hex[64] = '\0';
+   /* Step 4: SigningKey = HMAC-SHA256(DateRegionServiceKey, "aws4_request") */
+   if (!s3_hmac_sha256_bin(k_service, 32, "aws4_request", k_signing))
+      goto error;
+
+   /* Calculate final signature using the derived signing key in binary
+   * format
+   */
+   if (!s3_hmac_sha256_bin(k_signing, 32, string_to_sign, final_signature))
+   {
+      RARCH_ERR(S3_PFX "Failed to calculate final signature\n");
+      goto error;
+   }
+
+   /* Convert final signature to hex string */
+   for (i = 0; i < 32; i++)
+      snprintf(signature + 2 * i, 3, "%02x", (unsigned)final_signature[i]);
+
+   signature[64] = '\0';
+   return signature;
+
+error:
+   free(signature);
+   return NULL;
+}
+
+/* AWS Signature Version 4 calculation with provided timestamp */
+static char* s3_calculate_signature_v4_with_time(const char *method, const char *canonical_uri,
+                                      const char *query_string, const char *headers,
+                                      const char *payload_hash, const char *region,
+                                      const char *service, const char *access_key,
+                                      const char *secret_key, const char *host, time_t now)
+{
+   char *signature = NULL;
+   char date[16];
+   char datetime[32];
+   char credential_scope[128];
+   char canonical_request[4096];
+   char string_to_sign[4096];
+   char signed_headers[256];
+   char *canonical_headers = NULL;
+   char *canonical_query_string = NULL;
+   char *canonical_request_hash = NULL;
+
+   /* Use provided timestamp */
+   struct tm *tm_info = gmtime(&now);
+   strftime(date, sizeof(date), "%Y%m%d", tm_info);
+   strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
+
+   /* Build credential scope */
+   snprintf(credential_scope, sizeof(credential_scope), "%s/%s/%s/aws4_request",
+            date, region, service);
+
+   /* Build canonical headers */
+   if (headers)
+   {
+      /* Format headers for canonical request - must be sorted alphabetically
+       * and lowercase. Each header must be trimmed and end with a newline.
+       * Each header must be in the following order:
+       * host
+       * x-amz-content-sha256
+       * x-amz-date
+       */
+      canonical_headers = malloc(512);
+      if (canonical_headers)
+      {
+         snprintf(canonical_headers, 512, "host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n",
+                  host, payload_hash, datetime);
+      }
+
+   }
+
+   /* Build signed headers list */
+   snprintf(signed_headers, sizeof(signed_headers), "host;x-amz-content-sha256;x-amz-date");
+
+   /* Build canonical query string */
+   if (query_string)
+      canonical_query_string = s3_canonicalize_query_string(query_string);
+
+   /* Build canonical request */
+   snprintf(canonical_request, sizeof(canonical_request),
+            "%s\n%s\n%s\n%s\n%s\n%s",
+            method,
+            canonical_uri,
+            canonical_query_string ? canonical_query_string : "",
+            canonical_headers ? canonical_headers : "",
+            signed_headers,
+            payload_hash);
+
+   /* Calculate SHA256 hash of canonical request */
+   canonical_request_hash = s3_sha256_hash(canonical_request, strlen(canonical_request));
+   if (!canonical_request_hash)
+      goto cleanup;
+
+   /* Build string to sign */
+   snprintf(string_to_sign, sizeof(string_to_sign),
+            "%s\n%s\n%s\n%s",
+            S3_SIGNATURE_VERSION,
+            datetime,
+            credential_scope,
+            canonical_request_hash);
+
+   /* Calculate signature using AWS Signature Version 4 key derivation */
+   signature = s3_calculate_aws4_signature(secret_key, date, region, service, string_to_sign);
+   if (!signature)
+      RARCH_ERR(S3_PFX "Failed to calculate signature\n");
+
+   /* Cleanup */
+   cleanup:
+   if (canonical_headers)
+      free(canonical_headers);
+   if (canonical_query_string)
+      free(canonical_query_string);
+   if (canonical_request_hash)
+      free(canonical_request_hash);
+
+   return signature;
+}
+
+
+
+/* Build S3 authorization header */
+static char* s3_build_auth_header(const char *method, const char *canonical_uri,
+                                 const char *query_string, const char *headers,
+                                 const char *payload_hash, s3_state_t *s3_st)
+{
+   char *auth_header = NULL;
+   char *signature = NULL;
+   char date[16];
+   char datetime[32];
+   char credential[256];
+   time_t now;
+   struct tm *tm_info;
+
+   /* Get current time - use the same timestamp for signature and headers */
+   now = time(NULL);
+   tm_info = gmtime(&now);
+   strftime(date, sizeof(date), "%Y%m%d", tm_info);
+   strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
+
+   /* Calculate signature with the same timestamp */
+   signature = s3_calculate_signature_v4_with_time(method, canonical_uri, query_string, headers,
+                                        payload_hash, s3_st->region, S3_SERVICE,
+                                        s3_st->access_key_id, s3_st->secret_access_key,
+                                        s3_st->host, now);
+
+   if (!signature)
+      return NULL;
+
+   /* Build credential string */
+   snprintf(credential, sizeof(credential), "%s/%s/%s/%s/aws4_request",
+            s3_st->access_key_id, date, s3_st->region, S3_SERVICE);
+
+   /* Build authorization header */
+   auth_header = malloc(1024);
+   snprintf(auth_header, 1024,
+            "Authorization: %s Credential=%s, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=%s\r\n"
+            "x-amz-date: %s\r\n"
+            "x-amz-content-sha256: %s\r\n",
+            S3_SIGNATURE_VERSION, credential, signature, datetime, payload_hash);
+
+   free(signature);
+   return auth_header;
+}
+
+static void s3_log_http_snapshot(const http_transfer_data_t *data)
+{
+   const net_http_debug_state_t *dbg = NULL;
+
+   if (!data || !data->has_http_debug_state)
+      return;
+
+   dbg = &data->http_debug_state;
+   RARCH_LOG(S3_PFX
+         "HTTP snapshot: phase=%s status=%d err=%d last_errno=%d last_io_len=%lld fd=%d connected=%d request_sent=%d redirects=%u progress=%zu total=%zu ssl=%d\n",
+         net_http_phase_to_string(dbg->phase),
+         dbg->status,
+         dbg->err ? 1 : 0,
+         dbg->last_errno,
+         (long long)dbg->last_io_len,
+         dbg->fd,
+         dbg->connected ? 1 : 0,
+         dbg->request_sent ? 1 : 0,
+         dbg->redirects,
+         dbg->progress,
+         dbg->total,
+         dbg->ssl ? 1 : 0);
+}
+
+static void s3_log_http_failure(const char *path, http_transfer_data_t *data)
+{
+   size_t i;
+   RARCH_WARN(S3_PFX "Failed: %s: HTTP %d\n", path ? path : "<unknown>", data->status);
+   s3_log_http_snapshot(data);
+   for (i = 0; data->headers && i < data->headers->size; i++)
+      RARCH_WARN(S3_PFX "%s\n", data->headers->elems[i].data);
+   if (data->data)
+   {
+      data->data[data->len] = '\0';
+      RARCH_WARN(S3_PFX "%s\n", data->data);
+   }
+}
+
+static void s3_read_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && ((data->status >= 200 && data->status < 300) || data->status == 404 || data->status == 400));
+   RFILE *file                   = NULL;
+
+   (void)task;
+   (void)err;
+
+   if (!s3_cb_st)
+      return;
+
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for read '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
+
+   if (success && data && data->status >= 200 && data->status < 300)
+   {
+      file = filestream_open(s3_cb_st->file,
+            RETRO_VFS_FILE_ACCESS_READ_WRITE,
+            RETRO_VFS_FILE_ACCESS_HINT_NONE);
+      if (!file)
+      {
+         RARCH_WARN(S3_PFX "Failed to open local file for read '%s'\n", s3_cb_st->file);
+         success = false;
+      }
+      else
+      {
+         if (data->data && data->len > 0)
+            filestream_write(file, data->data, data->len);
+         filestream_seek(file, 0, SEEK_SET);
+      }
+   }
+
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, file);
+   free(s3_cb_st);
+}
+
+static void s3_update_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!s3_cb_st)
+      return;
+
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for update '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
+
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, s3_cb_st->rfile);
+   free(s3_cb_st);
+}
+
+static void s3_delete_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!s3_cb_st)
+      return;
+
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for delete '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
+
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, NULL);
+   free(s3_cb_st);
+}
+
+static bool s3_http_get_async(const char *url, const char *headers, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_headers(url, true, NULL,
+         headers, s3_read_cb, cb_state) != NULL;
+}
+
+static bool s3_http_put_async(const char *url, const char *headers,
+      const void *data, size_t data_len, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_content(url, "PUT",
+         data, data_len, "application/octet-stream", true, false,
+         headers, s3_update_cb, cb_state) != NULL;
+}
+
+static bool s3_http_delete_async(const char *url, const char *headers, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_headers(url, true, "DELETE",
+         headers, s3_delete_cb, cb_state) != NULL;
+}
+
+/* Normalize object key path to avoid malformed request URLs:
+ * - strip leading '/'
+ * - collapse repeated '/' inside key */
+static char* s3_normalize_object_key(const char *path)
+{
+   const char *src = path;
+   size_t src_len = 0;
+   char *normalized = NULL;
+   size_t out = 0;
+   bool prev_slash = false;
+
+   if (string_is_empty(path))
+      return strdup("");
+
+   while (*src == '/')
+      src++;
+
+   src_len = strlen(src);
+   normalized = (char*)malloc(src_len + 1);
+   if (!normalized)
+      return NULL;
+
+   while (*src)
+   {
+      if (*src == '/')
+      {
+         if (prev_slash)
+         {
+            src++;
+            continue;
+         }
+         prev_slash = true;
+      }
+      else
+         prev_slash = false;
+
+      normalized[out++] = *src++;
+   }
+
+   normalized[out] = '\0';
+   return normalized;
+}
+
+static bool s3_build_request_url(char *url, size_t url_size, s3_state_t *s3_st, const char *path)
+{
+   char base_url[PATH_MAX_LENGTH];
+   char *normalized_path = NULL;
+   char *encoded_path = NULL;
+   size_t base_len = 0;
+
+   if (!url || !s3_st || string_is_empty(s3_st->url))
+      return false;
+
+   if (string_is_empty(path))
+   {
+      strlcpy(url, s3_st->url, url_size);
+      return true;
+   }
+
+   normalized_path = s3_normalize_object_key(path);
+   if (!normalized_path)
+      return false;
+
+   encoded_path = s3_url_encode(normalized_path);
+   if (!encoded_path)
+   {
+      free(normalized_path);
+      return false;
+   }
+
+   strlcpy(base_url, s3_st->url, sizeof(base_url));
+   base_len = strlen(base_url);
+   while (base_len > 0 && base_url[base_len - 1] == '/')
+      base_url[--base_len] = '\0';
+
+   if (string_is_empty(encoded_path))
+      strlcpy(url, base_url, url_size);
+   else
+      snprintf(url, url_size, "%s/%s", base_url, encoded_path);
+
+   free(normalized_path);
+   free(encoded_path);
+   return true;
+}
+
+/* Build canonical URI from an already constructed request URL path component.
+ * This keeps signing aligned with the exact URL being requested, including any
+ * base path prefix (e.g. path-style bucket endpoints). */
+static bool s3_build_canonical_uri_from_url(const char *url, char *canonical_uri, size_t canonical_uri_size)
+{
+   const char *scheme_sep = NULL;
+   const char *authority = NULL;
+   const char *path_start = NULL;
+   const char *path_end = NULL;
+   size_t path_len = 0;
+
+   if (string_is_empty(url) || !canonical_uri || canonical_uri_size == 0)
+      return false;
+
+   scheme_sep = strstr(url, "://");
+   authority  = scheme_sep ? scheme_sep + 3 : url;
+   if (string_is_empty(authority))
+      return false;
+
+   path_start = strchr(authority, '/');
+   if (!path_start)
+   {
+      strlcpy(canonical_uri, "/", canonical_uri_size);
+      return true;
+   }
+
+   path_end = strpbrk(path_start, "?#");
+   path_len = path_end ? (size_t)(path_end - path_start) : strlen(path_start);
+
+   if (path_len == 0)
+   {
+      strlcpy(canonical_uri, "/", canonical_uri_size);
+      return true;
+   }
+
+   if (path_len >= canonical_uri_size)
+      return false;
+
+   strlcpy(canonical_uri, path_start, path_len + 1);
+   return true;
+}
+
+static char* s3_url_encode_query_value(const char *input)
+{
+   size_t input_len = 0;
+   size_t output_pos = 0;
+   size_t i = 0;
+   char *output = NULL;
+
+   if (!input)
+      return NULL;
+
+   input_len = strlen(input);
+   output = (char*)malloc(input_len * 3 + 1);
+   if (!output)
+      return NULL;
+
+   for (i = 0; i < input_len; i++)
+   {
+      unsigned char c = (unsigned char)input[i];
+      if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~')
+      {
+         output[output_pos++] = (char)c;
+      }
+      else
+      {
+         output[output_pos++] = '%';
+         output[output_pos++] = "0123456789ABCDEF"[c >> 4];
+         output[output_pos++] = "0123456789ABCDEF"[c & 0x0F];
+      }
+   }
+
+   output[output_pos] = '\0';
+   return output;
+}
+
+static char* s3_build_url_with_query(const char *url, const char *query)
+{
+   size_t total = 0;
+   char *result = NULL;
+
+   if (string_is_empty(url))
+      return NULL;
+
+   total = strlen(url) + (query ? strlen(query) : 0) + 2;
+   result = (char*)malloc(total);
+   if (!result)
+      return NULL;
+
+   if (query && *query)
+      snprintf(result, total, "%s?%s", url, query);
+   else
+      strlcpy(result, url, total);
+
+   return result;
+}
+
+static char* s3_extract_xml_tag_value(const char *xml, const char *tag_name)
+{
+   char open_tag[64];
+   char close_tag[64];
+   const char *start = NULL;
+   const char *end = NULL;
+   size_t len = 0;
+   char *value = NULL;
+
+   if (string_is_empty(xml) || string_is_empty(tag_name))
+      return NULL;
+
+   snprintf(open_tag, sizeof(open_tag), "<%s>", tag_name);
+   snprintf(close_tag, sizeof(close_tag), "</%s>", tag_name);
+
+   start = strstr(xml, open_tag);
+   if (!start)
+      return NULL;
+   start += strlen(open_tag);
+
+   end = strstr(start, close_tag);
+   if (!end || end <= start)
+      return NULL;
+
+   len = (size_t)(end - start);
+   value = (char*)malloc(len + 1);
+   if (!value)
+      return NULL;
+
+   memcpy(value, start, len);
+   value[len] = '\0';
+   return value;
+}
+
+static char* s3_extract_header_value(http_transfer_data_t *data, const char *header_name)
+{
+   size_t i;
+   char prefix[64];
+
+   if (!data || !data->headers || string_is_empty(header_name))
+      return NULL;
+
+   snprintf(prefix, sizeof(prefix), "%s:", header_name);
+
+   for (i = 0; i < data->headers->size; i++)
+   {
+      const char *line = data->headers->elems[i].data;
+      const char *start = NULL;
+      const char *end = NULL;
+      size_t len = 0;
+      char *out = NULL;
+
+      if (string_is_empty(line))
+         continue;
+      if (!string_starts_with_case_insensitive(line, prefix))
+         continue;
+
+      start = line + strlen(prefix);
+      while (*start == ' ' || *start == '\t')
+         start++;
+
+      end = start + strlen(start);
+      while (end > start && (end[-1] == '\r' || end[-1] == '\n' || end[-1] == ' ' || end[-1] == '\t'))
+         end--;
+
+      len = (size_t)(end - start);
+      out = (char*)malloc(len + 1);
+      if (!out)
+         return NULL;
+      memcpy(out, start, len);
+      out[len] = '\0';
+      return out;
+   }
+
+   return NULL;
+}
+
+static void s3_multipart_free(s3_multipart_state_t *mp_st)
+{
+   size_t i;
+   if (!mp_st)
+      return;
+
+   if (mp_st->part_etags)
+   {
+      for (i = 0; i < mp_st->part_count; i++)
+         free(mp_st->part_etags[i]);
+      free(mp_st->part_etags);
+   }
+
+   free(mp_st->upload_id);
+   free(mp_st->file_data);
+   free(mp_st->cb_state);
+   free(mp_st);
+}
+
+static void s3_multipart_finish(s3_multipart_state_t *mp_st, bool success)
+{
+   if (mp_st && mp_st->cb_state && mp_st->cb_state->cb)
+      mp_st->cb_state->cb(mp_st->cb_state->user_data, mp_st->cb_state->path, success, mp_st->cb_state->rfile);
+   s3_multipart_free(mp_st);
+}
+
+static void s3_multipart_upload_next_part(s3_multipart_state_t *mp_st);
+static void s3_multipart_abort(s3_multipart_state_t *mp_st);
+static bool s3_multipart_start(s3_multipart_state_t *mp_st);
+
+static bool s3_multipart_part_bounds(const s3_multipart_state_t *mp_st,
+      size_t part_index, size_t *out_offset, size_t *out_content_len)
+{
+   size_t offset;
+   size_t remaining;
+   size_t content_len;
+
+   if (!mp_st || !out_offset || !out_content_len)
+      return false;
+   if (part_index >= mp_st->part_count)
+      return false;
+   if (!mp_st->part_size)
+      return false;
+   if (part_index > (mp_st->file_size / mp_st->part_size))
+      return false;
+
+   offset = part_index * mp_st->part_size;
+   if (offset >= mp_st->file_size)
+      return false;
+
+   remaining   = mp_st->file_size - offset;
+   content_len = remaining < mp_st->part_size ? remaining : mp_st->part_size;
+   if (!content_len)
+      return false;
+   if (content_len > (mp_st->file_size - offset))
+      return false;
+
+   *out_offset      = offset;
+   *out_content_len = content_len;
+   return true;
+}
+
+static void s3_log_multipart_initiate_failure(
+      s3_multipart_state_t *mp_st, http_transfer_data_t *data, const char *err)
+{
+   size_t i;
+
+   if (!mp_st)
+      return;
+
+   RARCH_WARN(S3_PFX "Multipart initiate diagnostic: path='%s' url_query='uploads=' canonical_query='uploads=' data=%s status=%d len=%zu headers=%zu err='%s'\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>",
+         data ? "present" : "missing",
+         data ? data->status : -1,
+         data ? data->len : 0,
+         (data && data->headers) ? data->headers->size : 0,
+         (err && *err) ? err : "<none>");
+   s3_log_http_snapshot(data);
+
+   if (data && data->headers)
+      for (i = 0; i < data->headers->size; i++)
+         RARCH_WARN(S3_PFX "Multipart initiate header[%zu]: %s\n", i, data->headers->elems[i].data);
+
+   if (data && data->data && data->len > 0)
+   {
+      data->data[data->len] = '\0';
+      RARCH_WARN(S3_PFX "Multipart initiate body: %s\n", data->data);
+   }
+}
+
+static bool s3_multipart_fallback_single_put(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *payload_hash = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || !mp_st->cb_state)
+      return false;
+
+   if (mp_st->file_data && mp_st->file_size > 0)
+      payload_hash = s3_sha256_hash(mp_st->file_data, mp_st->file_size);
+   else
+      payload_hash = strdup(S3_EMPTY_PAYLOAD_SHA256);
+
+   if (!payload_hash)
+      return false;
+
+   auth_header = s3_build_auth_header("PUT", mp_st->canonical_uri, "",
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!auth_header)
+   {
+      free(payload_hash);
+      return false;
+   }
+
+   if (!s3_http_put_async(mp_st->url, auth_header,
+            mp_st->file_data, mp_st->file_size, mp_st->cb_state))
+   {
+      free(payload_hash);
+      free(auth_header);
+      return false;
+   }
+
+   /* Callback ownership transferred to the HTTP task. */
+   mp_st->cb_state = NULL;
+
+   free(payload_hash);
+   free(auth_header);
+   return true;
+}
+
+static void s3_multipart_fail(s3_multipart_state_t *mp_st, http_transfer_data_t *data, const char *phase)
+{
+   if (!mp_st)
+      return;
+
+   if (data)
+      s3_log_http_failure(mp_st->cb_state ? mp_st->cb_state->path : phase, data);
+   else
+      RARCH_WARN(S3_PFX "Multipart upload failed during %s\n", phase ? phase : "unknown phase");
+
+   if (!string_is_empty(mp_st->upload_id) && !mp_st->aborting)
+      s3_multipart_abort(mp_st);
+   else
+      s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_abort_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+      RARCH_WARN(S3_PFX "Multipart abort request was not successful\n");
+
+   s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_abort(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || string_is_empty(mp_st->upload_id))
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   mp_st->aborting = true;
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!encoded_upload_id)
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 16);
+   if (!query)
+   {
+      free(encoded_upload_id);
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+   snprintf(query, strlen(encoded_upload_id) + 16, "uploadId=%s", encoded_upload_id);
+
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("DELETE", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", S3_EMPTY_PAYLOAD_SHA256, s3_st);
+
+   if (!url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_headers(url_with_query, true, "DELETE",
+            auth_header, s3_multipart_abort_cb, mp_st))
+      goto fail;
+
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   return;
+
+fail:
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_complete_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_multipart_fail(mp_st, data, "complete");
+      return;
+   }
+
+   RARCH_LOG(S3_PFX "Multipart upload complete: %s (%zu parts)\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>",
+         mp_st->part_count);
+   s3_multipart_finish(mp_st, true);
+}
+
+static void s3_multipart_complete(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *payload_hash = NULL;
+   char *auth_header = NULL;
+   char *xml_body = NULL;
+   size_t i;
+   size_t xml_len = 0;
+   size_t xml_cap = 128;
+
+   if (!mp_st || string_is_empty(mp_st->upload_id))
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   for (i = 0; i < mp_st->part_count; i++)
+   {
+      if (string_is_empty(mp_st->part_etags[i]))
+      {
+         s3_multipart_fail(mp_st, NULL, "complete missing ETag");
+         return;
+      }
+      xml_cap += strlen(mp_st->part_etags[i]) + 96;
+   }
+
+   xml_body = (char*)malloc(xml_cap);
+   if (!xml_body)
+   {
+      s3_multipart_fail(mp_st, NULL, "complete allocation");
+      return;
+   }
+
+   xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len,
+         "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<CompleteMultipartUpload>\n");
+   for (i = 0; i < mp_st->part_count; i++)
+      xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len,
+            "  <Part><PartNumber>%u</PartNumber><ETag>%s</ETag></Part>\n",
+            (unsigned)(i + 1), mp_st->part_etags[i]);
+   xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len, "</CompleteMultipartUpload>");
+
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!encoded_upload_id)
+      goto fail;
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 16);
+   if (!query)
+      goto fail;
+   snprintf(query, strlen(encoded_upload_id) + 16, "uploadId=%s", encoded_upload_id);
+
+   payload_hash = s3_sha256_hash(xml_body, xml_len);
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("POST", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!payload_hash || !url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_content(url_with_query, "POST",
+            xml_body, xml_len, "application/xml", true, false,
+            auth_header, s3_multipart_complete_cb, mp_st))
+      goto fail;
+
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(payload_hash);
+   free(auth_header);
+   free(xml_body);
+   return;
+
+fail:
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(payload_hash);
+   free(auth_header);
+   free(xml_body);
+   s3_multipart_fail(mp_st, NULL, "complete start");
+}
+
+static void s3_multipart_upload_part_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+   char *etag = NULL;
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_multipart_fail(mp_st, data, "upload part");
+      return;
+   }
+
+   etag = s3_extract_header_value(data, "ETag");
+   if (!etag)
+   {
+      RARCH_WARN(S3_PFX "Missing ETag for multipart part %u\n", (unsigned)(mp_st->current_part + 1));
+      s3_multipart_fail(mp_st, data, "upload part missing etag");
+      return;
+   }
+
+   mp_st->part_etags[mp_st->current_part] = etag;
+   mp_st->current_part++;
+
+   if (mp_st->current_part >= mp_st->part_count)
+      s3_multipart_complete(mp_st);
+   else
+      s3_multipart_upload_next_part(mp_st);
+}
+
+static void s3_multipart_upload_next_part(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   size_t offset = 0;
+   size_t content_len = 0;
+   unsigned part_number;
+   char *payload_hash = NULL;
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || mp_st->current_part >= mp_st->part_count)
+      return;
+
+   if (!s3_multipart_part_bounds(mp_st, mp_st->current_part, &offset, &content_len))
+   {
+      RARCH_WARN(S3_PFX "Multipart upload part bounds check failed for part %u (parts=%zu file_size=%zu part_size=%zu)\n",
+            (unsigned)(mp_st->current_part + 1),
+            mp_st->part_count,
+            mp_st->file_size,
+            mp_st->part_size);
+      goto fail;
+   }
+   part_number = (unsigned)(mp_st->current_part + 1);
+
+   payload_hash = s3_sha256_hash(mp_st->file_data + offset, content_len);
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!payload_hash || !encoded_upload_id)
+      goto fail;
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 48);
+   if (!query)
+      goto fail;
+   snprintf(query, strlen(encoded_upload_id) + 48,
+         "partNumber=%u&uploadId=%s", part_number, encoded_upload_id);
+
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("PUT", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_content(url_with_query, "PUT",
+            mp_st->file_data + offset, content_len, "application/octet-stream", true, true,
+            auth_header, s3_multipart_upload_part_cb, mp_st))
+      goto fail;
+
+   free(payload_hash);
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   return;
+
+fail:
+   free(payload_hash);
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   s3_multipart_fail(mp_st, NULL, "upload part start");
+}
+
+static void s3_multipart_initiate_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+   char *response_xml            = NULL;
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_log_multipart_initiate_failure(mp_st, data, err);
+
+      if (!data || data->status < 0)
+      {
+         RARCH_WARN(S3_PFX "Multipart initiation transport failed (data=%s, status=%d); falling back to single PUT for '%s'\n",
+               data ? "present" : "missing",
+               data ? data->status : -1,
+               mp_st->cb_state ? mp_st->cb_state->path : "<unknown>");
+         if (s3_multipart_fallback_single_put(mp_st))
+         {
+            s3_multipart_free(mp_st);
+            return;
+         }
+      }
+
+      if (err && *err)
+         RARCH_WARN(S3_PFX "Multipart initiate transport error: %s\n", err);
+      s3_multipart_fail(mp_st, data, "initiate");
+      return;
+   }
+
+   if (!data || string_is_empty(data->data))
+   {
+      s3_multipart_fail(mp_st, data, "initiate empty response");
+      return;
+   }
+
+   response_xml = (char*)malloc(data->len + 1);
+   if (!response_xml)
+   {
+      s3_multipart_fail(mp_st, data, "initiate allocation");
+      return;
+   }
+   memcpy(response_xml, data->data, data->len);
+   response_xml[data->len] = '\0';
+
+   mp_st->upload_id = s3_extract_xml_tag_value(response_xml, "UploadId");
+   free(response_xml);
+   if (string_is_empty(mp_st->upload_id))
+   {
+      RARCH_WARN(S3_PFX "Multipart initiation response missing UploadId\n");
+      s3_multipart_fail(mp_st, data, "initiate missing upload id");
+      return;
+   }
+
+   RARCH_LOG(S3_PFX "Started multipart upload for %s (uploadId=%s, parts=%zu)\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>", mp_st->upload_id, mp_st->part_count);
+   s3_multipart_upload_next_part(mp_st);
+}
+
+static bool s3_multipart_start(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+   const char *url_query = "uploads=";
+   const char *canonical_query = "uploads=";
+
+   if (!mp_st)
+      return false;
+
+   url_with_query = s3_build_url_with_query(mp_st->url, url_query);
+   auth_header = s3_build_auth_header("POST", mp_st->canonical_uri, canonical_query,
+         "host;x-amz-content-sha256;x-amz-date", S3_EMPTY_PAYLOAD_SHA256, s3_st);
+   if (!url_with_query || !auth_header)
+   {
+      free(url_with_query);
+      free(auth_header);
+      return false;
+   }
+
+   RARCH_DBG(S3_PFX "Multipart initiate URL: %s\n", url_with_query);
+   RARCH_DBG(S3_PFX "Multipart initiate headers:\n%s\n", auth_header);
+
+   if (!task_push_http_post_transfer_with_headers(url_with_query, "",
+            true, "POST", auth_header,
+            s3_multipart_initiate_cb, mp_st))
+   {
+      free(url_with_query);
+      free(auth_header);
+      return false;
+   }
+
+   free(url_with_query);
+   free(auth_header);
+   return true;
+}
+
+/* Initialize S3 connection */
+static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   settings_t *settings = config_get_ptr();
+
+   if (!settings)
+      return false;
+
+   /* Copy configuration - TODO: Use actual settings when available */
+   strlcpy(s3_st->url, settings->arrays.s3_url, sizeof(settings->arrays.s3_url));
+   strlcpy(s3_st->access_key_id, settings->arrays.access_key_id, sizeof(settings->arrays.access_key_id));
+   strlcpy(s3_st->secret_access_key, settings->arrays.secret_access_key, sizeof(settings->arrays.secret_access_key));
+
+   RARCH_DBG(S3_PFX "S3 configuration - URL: '%s'\n", s3_st->url);
+
+   /* Parse URL to extract bucket, region, and host */
+   if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host, S3_SERVICE))
+      RARCH_WARN(S3_PFX "Could not parse bucket/region from URL, using defaults\n");
+
+   /* Validate configuration */
+   if (string_is_empty(s3_st->url) || string_is_empty(s3_st->access_key_id) ||
+       string_is_empty(s3_st->secret_access_key))
+   {
+      RARCH_ERR(S3_PFX "Missing S3 configuration\n");
+      return false;
+   }
+
+   RARCH_LOG(S3_PFX "S3 sync initialized for bucket: %s in region: %s\n",
+             s3_st->bucket, s3_st->region);
+
+   s3_st->connected = true;
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, NULL, true, NULL);
+
+   return true;
+}
+
+/* Clean up S3 connection */
+static bool s3_sync_end(cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+
+   s3_st->connected = false;
+   RARCH_LOG(S3_PFX "S3 sync ended\n");
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, NULL, true, NULL);
+
+   return true;
+}
+
+/* Read file from S3 */
+static bool s3_read(const char *path, const char *file, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   bool success = false;
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+   strlcpy(s3_cb_st->file, file, sizeof(s3_cb_st->file));
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
+
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
+
+   /* Build authorization header */
+   auth_header = s3_build_auth_header("GET", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", s3_st);
+
+   if (!auth_header)
+   {
+      RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+      goto cleanup;
+   }
+
+   RARCH_DBG(S3_PFX "Request URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+
+   /* Perform HTTP GET request asynchronously */
+   if (!s3_http_get_async(url, auth_header, s3_cb_st))
+   {
+      RARCH_ERR(S3_PFX "Failed to start HTTP GET request\n");
+      goto cleanup;
+   }
+
+   /* Ownership transferred to async callback */
+   s3_cb_st = NULL;
+   success = true;
+
+cleanup:
+   free(auth_header);
+   free(s3_cb_st);
+
+   return success;
+}
+
+/* Update file to S3 */
+static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_multipart_state_t *mp_st = NULL;
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   char *file_data = NULL;
+   size_t file_size = 0;
+   char *payload_hash = NULL;
+   size_t multipart_threshold = s3_get_multipart_nominal_threshold_bytes();
+   bool success = false;
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   s3_cb_st->rfile = file;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+
+   /* Get file size and data */
+   if (file)
+   {
+      filestream_seek(file, 0, SEEK_END);
+      file_size = filestream_tell(file);
+      filestream_seek(file, 0, SEEK_SET);
+
+      if (file_size > 0)
+      {
+         file_data = malloc(file_size);
+         if (file_data)
+            filestream_read(file, file_data, file_size);
+         else
+         {
+            RARCH_ERR(S3_PFX "Failed to allocate memory for upload (%zu bytes)\n", file_size);
+            goto cleanup;
+         }
+      }
+   }
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
+
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
+
+   RARCH_DBG(S3_PFX "Request URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+
+   /* For large files, use multipart upload */
+   if (file_size > multipart_threshold)
+   {
+      size_t part_size = 0;
+      size_t part_count = 0;
+
+      RARCH_LOG(S3_PFX "Large file detected (%zu bytes, nominal multipart threshold: %zu bytes), using multipart upload\n",
+            file_size, multipart_threshold);
+
+      if (!s3_calculate_multipart_plan(file_size, &part_size, &part_count))
+      {
+         RARCH_ERR(S3_PFX "Could not build multipart plan for %zu-byte upload\n", file_size);
+         goto cleanup;
+      }
+
+      mp_st = (s3_multipart_state_t*)calloc(1, sizeof(*mp_st));
+      if (!mp_st)
+         goto cleanup;
+
+      mp_st->cb_state = s3_cb_st;
+      s3_cb_st = NULL;
+      mp_st->file_data = file_data;
+      file_data = NULL;
+      mp_st->file_size = file_size;
+      mp_st->part_size = part_size;
+      mp_st->part_count = part_count;
+      strlcpy(mp_st->url, url, sizeof(mp_st->url));
+      strlcpy(mp_st->canonical_uri, canonical_uri, sizeof(mp_st->canonical_uri));
+      mp_st->part_etags = (char**)calloc(part_count, sizeof(char*));
+      if (!mp_st->part_etags)
+         goto cleanup;
+
+      RARCH_LOG(S3_PFX "Multipart plan: %zu bytes in %zu parts (%zu bytes/part)\n",
+            file_size, part_count, part_size);
+
+      if (!s3_multipart_start(mp_st))
+      {
+         RARCH_ERR(S3_PFX "Failed to start multipart upload\n");
+         goto cleanup;
+      }
+
+      /* Ownership transferred to multipart callbacks */
+      s3_cb_st = NULL;
+      file_data = NULL;
+      mp_st = NULL;
+      success = true;
+   }
+   else
+   {
+      /* Single PUT request */
+      if (file_data && file_size > 0)
+         payload_hash = s3_sha256_hash(file_data, file_size);
+      else
+         payload_hash = strdup(S3_EMPTY_PAYLOAD_SHA256);
+
+      if (!payload_hash)
+      {
+         RARCH_ERR(S3_PFX "Failed to compute payload hash\n");
+         goto cleanup;
+      }
+
+      auth_header = s3_build_auth_header("PUT", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                        payload_hash, s3_st);
+
+      if (!auth_header)
+      {
+         RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+         goto cleanup;
+      }
+
+      /* Perform HTTP PUT request */
+      if (!s3_http_put_async(url, auth_header, file_data, file_size, s3_cb_st))
+      {
+         RARCH_ERR(S3_PFX "Failed to start HTTP PUT request\n");
+         goto cleanup;
+      }
+      /* Ownership transferred to async callback */
+      s3_cb_st = NULL;
+      success = true;
+   }
+
+cleanup:
+   s3_multipart_free(mp_st);
+   free(auth_header);
+   free(file_data);
+   free(payload_hash);
+   free(s3_cb_st);
+
+   return success;
+}
+
+/* Delete file from S3 */
+static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   bool success = false;
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
+
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
+
+   /* Build authorization header */
+   auth_header = s3_build_auth_header("DELETE", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", s3_st);
+
+   if (!auth_header)
+   {
+      RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+      goto cleanup;
+   }
+
+   /* Perform HTTP DELETE request */
+   success = s3_http_delete_async(url, auth_header, s3_cb_st);
+   if (!success)
+   {
+      RARCH_ERR(S3_PFX "Failed to start HTTP DELETE request\n");
+      goto cleanup;
+   }
+   /* Ownership transferred to async callback */
+   s3_cb_st = NULL;
+
+cleanup:
+   free(auth_header);
+   free(s3_cb_st);
+
+   return success;
+}
+
+/* S3 cloud sync driver */
+cloud_sync_driver_t cloud_sync_s3 = {
+   s3_sync_begin,
+   s3_sync_end,
+   s3_read,
+   s3_update,
+   s3_free,
+   "s3"
+};
diff --git a/network/cloud_sync_driver.c b/network/cloud_sync_driver.c
index acd774ea9468..e7bfd78477d0 100644
--- a/network/cloud_sync_driver.c
+++ b/network/cloud_sync_driver.c
@@ -31,6 +31,9 @@ const cloud_sync_driver_t *cloud_sync_drivers[] = {
 #ifdef HAVE_SSL
    &cloud_sync_google_drive,
 #endif
+#ifdef HAVE_S3
+   &cloud_sync_s3,
+#endif
 #ifdef HAVE_ICLOUD
    &cloud_sync_icloud,
 #endif
diff --git a/network/cloud_sync_driver.h b/network/cloud_sync_driver.h
index e852f9fbbb9f..96c818b0bc1e 100644
--- a/network/cloud_sync_driver.h
+++ b/network/cloud_sync_driver.h
@@ -52,6 +52,9 @@ extern cloud_sync_driver_t cloud_sync_webdav;
 #ifdef HAVE_SSL
 extern cloud_sync_driver_t cloud_sync_google_drive;
 #endif
+#ifdef HAVE_S3
+extern cloud_sync_driver_t cloud_sync_s3;
+#endif
 #ifdef HAVE_ICLOUD
 extern cloud_sync_driver_t cloud_sync_icloud;
 #endif
diff --git a/pkg/apple/BaseConfig.xcconfig b/pkg/apple/BaseConfig.xcconfig
index 930a0974a21f..f9d5837bc581 100644
--- a/pkg/apple/BaseConfig.xcconfig
+++ b/pkg/apple/BaseConfig.xcconfig
@@ -74,6 +74,7 @@ OTHER_CFLAGS = $(inherited) -DHAVE_RPNG
 OTHER_CFLAGS = $(inherited) -DHAVE_RTGA
 OTHER_CFLAGS = $(inherited) -DHAVE_RUNAHEAD
 OTHER_CFLAGS = $(inherited) -DHAVE_RWAV
+OTHER_CFLAGS = $(inherited) -DHAVE_S3
 OTHER_CFLAGS = $(inherited) -DHAVE_SCREENSHOTS
 OTHER_CFLAGS = $(inherited) -DHAVE_SHADERPIPELINE
 OTHER_CFLAGS = $(inherited) -DHAVE_SLANG
diff --git a/tasks/task_http.c b/tasks/task_http.c
index 1406f9efde9d..8c4039164963 100644
--- a/tasks/task_http.c
+++ b/tasks/task_http.c
@@ -48,6 +48,7 @@ struct http_handle
    } connection;
    enum http_status_enum status;
    bool error;
+   bool headers_accept_err;
    char connection_url[NAME_MAX_LENGTH];
 };
 
@@ -186,8 +187,10 @@ static void task_http_transfer_handler(retro_task_t *task)
          data          = (http_transfer_data_t*)malloc(sizeof(*data));
          data->data    = tmp;
          data->len     = _len;
-         data->headers = net_http_headers(http->handle);
+         data->headers = net_http_headers_ex(http->handle, http->headers_accept_err);
          data->status  = net_http_status(http->handle);
+         data->has_http_debug_state =
+               net_http_get_debug_state(http->handle, &data->http_debug_state);
 
          task_set_data(task, data);
 
@@ -238,7 +241,7 @@ static void http_transfer_progress_cb(retro_task_t *task)
 
 static void *task_push_http_transfer_generic(
       struct http_connection_t *conn,
-      const char *url, bool mute,
+      const char *url, bool mute, bool headers_accept_err,
       retro_task_callback_t cb, void *user_data)
 {
    retro_task_t  *t        = NULL;
@@ -277,6 +280,7 @@ static void *task_push_http_transfer_generic(
    http->connection.cb       = &cb_http_conn_default;
    http->status              = HTTP_STATUS_CONNECTION_TRANSFER;
    http->error               = false;
+   http->headers_accept_err = headers_accept_err;
    http->connection_url[0]   = '\0';
 
    strlcpy(http->connection_url, url, sizeof(http->connection_url));
@@ -317,7 +321,7 @@ void* task_push_http_transfer(const char *url, bool mute,
    if (!string_is_empty(url))
       return task_push_http_transfer_generic(
             net_http_connection_new(url, type ? type : "GET", NULL),
-            url, mute, cb, user_data);
+            url, mute, false, cb, user_data);
    return NULL;
 }
 
@@ -335,7 +339,7 @@ void *task_push_webdav_stat(const char *url, bool mute, const char *headers,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_mkdir(const char *url, bool mute,
@@ -353,7 +357,7 @@ void* task_push_webdav_mkdir(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_put(const char *url,
@@ -380,7 +384,7 @@ void* task_push_webdav_put(const char *url,
    if (put_data)
       net_http_connection_set_content(conn, NULL, len, put_data);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_delete(const char *url, bool mute,
@@ -398,7 +402,7 @@ void* task_push_webdav_delete(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void *task_push_webdav_move(const char *url,
@@ -424,7 +428,7 @@ void *task_push_webdav_move(const char *url,
 
    net_http_connection_set_headers(conn, dest_header);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, userdata);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, userdata);
 }
 
 void* task_push_http_transfer_file(const char* url, bool mute,
@@ -442,7 +446,7 @@ void* task_push_http_transfer_file(const char* url, bool mute,
    if (!(t = (retro_task_t*)task_push_http_transfer_generic(
          /* should be using type but some callers now rely on type being ignored */
          net_http_connection_new(url, "GET", NULL),
-         url, mute, cb, transfer_data)))
+         url, mute, false, cb, transfer_data)))
       return NULL;
 
    if (transfer_data)
@@ -480,7 +484,7 @@ void* task_push_http_transfer_with_user_agent(const char *url, bool mute,
    if (user_agent)
       net_http_connection_set_user_agent(conn, user_agent);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_transfer_with_headers(const char *url, bool mute,
@@ -498,7 +502,7 @@ void* task_push_http_transfer_with_headers(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_post_transfer(const char *url,
@@ -508,7 +512,7 @@ void* task_push_http_post_transfer(const char *url,
    if (!string_is_empty(url))
       return task_push_http_transfer_generic(
             net_http_connection_new(url, type ? type : "POST", post_data),
-            url, mute, cb, user_data);
+            url, mute, false, cb, user_data);
    return NULL;
 }
 
@@ -528,7 +532,7 @@ void* task_push_http_post_transfer_with_user_agent(const char *url,
    if (user_agent)
       net_http_connection_set_user_agent(conn, user_agent);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_post_transfer_with_headers(const char *url,
@@ -547,13 +551,13 @@ void* task_push_http_post_transfer_with_headers(const char *url,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void *task_push_http_transfer_with_content(const char *url,
       const char *method, const void *content, size_t content_len,
-      const char *content_type, bool mute, const char *headers,
-      retro_task_callback_t cb, void *user_data)
+      const char *content_type, bool mute, bool headers_accept_err,
+      const char *headers, retro_task_callback_t cb, void *user_data)
 {
    struct http_connection_t *conn;
 
@@ -570,5 +574,6 @@ void *task_push_http_transfer_with_content(const char *url,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute,
+         headers_accept_err, cb, user_data);
 }
diff --git a/tasks/tasks_internal.h b/tasks/tasks_internal.h
index e5dc47cf195a..f636a42e9b70 100644
--- a/tasks/tasks_internal.h
+++ b/tasks/tasks_internal.h
@@ -32,6 +32,7 @@
 
 #if defined(HAVE_NETWORKING)
 #include "../core_updater_list.h"
+#include <net/net_http.h>
 #endif
 
 #include "../playlist.h"
@@ -59,6 +60,8 @@ typedef struct
    struct string_list *headers;
    size_t len;
    int status;
+   bool has_http_debug_state;
+   net_http_debug_state_t http_debug_state;
 } http_transfer_data_t;
 
 void *task_push_http_transfer(const char *url, bool mute, const char *type,
@@ -81,7 +84,8 @@ void *task_push_http_post_transfer_with_headers(const char *url, const char *pos
 
 void *task_push_http_transfer_with_content(const char *url, const char *method,
    const void *content, size_t content_len, const char *content_type, bool mute,
-   const char *headers, retro_task_callback_t cb, void *user_data);
+   bool headers_accept_err, const char *headers,
+   retro_task_callback_t cb, void *user_data);
 
 void *task_push_webdav_stat(const char *url, bool mute, const char *headers,
       retro_task_callback_t cb, void *userdata);