diff --git a/weed/iam/sts/session_helpers.go b/weed/iam/sts/session_helpers.go
index e13d1297d..64abc23d4 100644
--- a/weed/iam/sts/session_helpers.go
+++ b/weed/iam/sts/session_helpers.go
@@ -7,6 +7,11 @@ func (c *Credentials) IsExpired() bool {
 	if c == nil {
 		return true
 	}
+	// Treat zero-time expiration as expired (uninitialized credentials)
+	// This prevents treating uninitialized credentials as valid
+	if c.Expiration.IsZero() {
+		return true
+	}
 	return time.Now().After(c.Expiration)
 }
 
@@ -16,5 +21,9 @@ func (s *SessionInfo) IsExpired() bool {
 	if s == nil {
 		return true
 	}
+	// Treat zero-time expiration as expired (uninitialized session)
+	if s.ExpiresAt.IsZero() {
+		return true
+	}
 	return time.Now().After(s.ExpiresAt)
 }