diff --git a/packages/opencode/src/plugin/codex.ts b/packages/opencode/src/plugin/codex.ts
index e05111fc6ad7..ff7a22f15b6c 100644
--- a/packages/opencode/src/plugin/codex.ts
+++ b/packages/opencode/src/plugin/codex.ts
@@ -374,6 +374,7 @@ export async function CodexAuthPlugin(input: PluginInput): Promise<Hooks> {
           "gpt-5.3-codex",
           "gpt-5.4",
           "gpt-5.4-mini",
+          "gpt-5.5",
         ])
         for (const [modelId, model] of Object.entries(provider.models)) {
           if (modelId.includes("codex")) continue
diff --git a/packages/opencode/src/provider/provider.ts b/packages/opencode/src/provider/provider.ts
index d643f25373af..3d526d0d7bc0 100644
--- a/packages/opencode/src/provider/provider.ts
+++ b/packages/opencode/src/provider/provider.ts
@@ -1,5 +1,6 @@
 import z from "zod"
 import os from "os"
+import { spawn } from "child_process"
 import fuzzysort from "fuzzysort"
 import { Config } from "../config"
 import { mapValues, mergeDeep, omit, pickBy, sortBy } from "remeda"
@@ -291,7 +292,23 @@ function custom(dep: CustomDep): Record<string, CustomLoader> {
         // Build credential provider options (only pass profile if specified)
         const credentialProviderOptions = profile ? { profile } : {}
 
-        providerOptions.credentialProvider = fromNodeProviderChain(credentialProviderOptions)
+        const rawProvider = fromNodeProviderChain(credentialProviderOptions)
+        providerOptions.credentialProvider = async () => {
+          try {
+            return await rawProvider()
+          } catch (e) {
+            if (e instanceof Error && e.name === "CredentialsProviderError") {
+              await new Promise<void>((resolve, reject) => {
+                const args = ["sso", "login", ...(profile ? ["--profile", profile] : [])]
+                const child = spawn("aws", args, { stdio: "pipe" })
+                child.on("exit", (code) => (code === 0 ? resolve() : reject(e)))
+                child.on("error", () => reject(e))
+              })
+              return await rawProvider()
+            }
+            throw e
+          }
+        }
       }
 
       // Add custom endpoint if specified (endpoint takes precedence over baseURL)