diff --git a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java
index dcb4bdbf1d..d6c21ef7ee 100644
--- a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java
+++ b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java
@@ -4,8 +4,8 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.jspecify.annotations.NonNull;
-import org.springframework.boot.SpringApplication;
 import org.springframework.boot.EnvironmentPostProcessor;
+import org.springframework.boot.SpringApplication;
 import org.springframework.core.Ordered;
 import org.springframework.core.env.ConfigurableEnvironment;
 import org.springframework.core.env.EnumerablePropertySource;
@@ -58,8 +58,9 @@
  * <p>SSM initialization also runs when {@code context.awsParameterStore.prefix} is explicitly
  * configured (even with no {@code ssm:} values), so that the CloudServices module can create its
  * own {@code SsmClient} for on-demand {@code SecretService} lookups. When active, this processor
- * publishes {@code labkey.aws.ssm.region} and optionally {@code labkey.aws.ssm.secretsPrefix} as
- * JVM system properties without any cross-classloader reflection.
+ * publishes {@code labkey.aws.ssm.enabled}, {@code labkey.aws.ssm.region}, and
+ * {@code labkey.aws.ssm.secretsPrefix} as JVM system properties without any cross-classloader
+ * reflection.
  *
  * <p>{@code context.awsParameterStore.secretsPrefix} controls where {@code SecretProperty}
  * values are looked up at runtime. A relative value (no leading {@code /}) is resolved against
@@ -146,7 +147,9 @@ public void postProcessEnvironment(ConfigurableEnvironment environment, SpringAp
         Region region = resolveRegion(regionOverride);
 
         // Publish config as system properties so the CloudServices module can create its own
-        // SsmClient for on-demand SecretProperty lookups via SecretService at runtime.
+        // SsmClient for on-demand SecretProperty lookups via SecretService at runtime. The enabled
+        // flag carries the hasExplicitConfig decision above for use in SsmSecretProvider
+        System.setProperty("labkey.aws.ssm.enabled", "true");
         System.setProperty("labkey.aws.ssm.region", region.id());
         System.setProperty("labkey.aws.ssm.secretsPrefix", secretsPrefix);