diff --git a/docker/postgres-kanister-tools/requirements.txt b/docker/postgres-kanister-tools/requirements.txt
index 9887c7d51b..e1e713f440 100644
--- a/docker/postgres-kanister-tools/requirements.txt
+++ b/docker/postgres-kanister-tools/requirements.txt
@@ -1,4 +1,4 @@
-awscli==1.35.20
+awscli==1.36.10
 pip==24.3.1
-setuptools==75.3.0
-wheel==0.44.0
+setuptools==75.6.0
+wheel==0.45.1
diff --git a/docker/postgresql/requirements.txt b/docker/postgresql/requirements.txt
index 5bfbb11d44..fdc1cfa954 100644
--- a/docker/postgresql/requirements.txt
+++ b/docker/postgresql/requirements.txt
@@ -1,5 +1,5 @@
-awscli==1.35.20
+awscli==1.36.10
 wal-e==1.1.1
 pip==24.3.1
-setuptools==75.3.0
-wheel==0.44.0
+setuptools==75.6.0
+wheel==0.45.1
diff --git a/pkg/blockstorage/azure/azuredisk.go b/pkg/blockstorage/azure/azuredisk.go
index 24ffe5cb09..e67d6ef07a 100644
--- a/pkg/blockstorage/azure/azuredisk.go
+++ b/pkg/blockstorage/azure/azuredisk.go
@@ -549,12 +549,12 @@ func (s *AdStorage) SnapshotsList(ctx context.Context, tags map[string]string) (
 			return nil, errkit.Wrap(err, "SnapshotsClient.List in SnapshotsList")
 		}
 		for _, snap := range page.Value {
-			k10Snap, err := s.SnapshotParse(ctx, *snap)
+			parsedSnap, err := s.SnapshotParse(ctx, *snap)
 			if err != nil {
 				log.WithError(err).Print("Incorrect Snaphost type", field.M{"SnapshotID": snap.ID})
 				continue
 			}
-			snaps = append(snaps, k10Snap)
+			snaps = append(snaps, parsedSnap)
 		}
 	}
 	snaps = blockstorage.FilterSnapshotsWithTags(snaps, blockstorage.SanitizeTags(tags))
diff --git a/pkg/blockstorage/tags/tags.go b/pkg/blockstorage/tags/tags.go
index ae99e2eec0..95dbb3faea 100644
--- a/pkg/blockstorage/tags/tags.go
+++ b/pkg/blockstorage/tags/tags.go
@@ -27,7 +27,7 @@ import (
 const (
 	// ClusterTagKey is used to tag resources with the cluster name
 	ClusterTagKey = "kanister.io/clustername"
-	// VersionTagKey is used to tag resources with the K10 version
+	// VersionTagKey is used to tag resources with a version
 	VersionTagKey = "kanister.io/version"
 	// AppNameTag is used to tag volumes with the app they belong to
 	AppNameTag = "kanister.io/appname"
diff --git a/pkg/function/export_rds_snapshot_location.go b/pkg/function/export_rds_snapshot_location.go
index c2df143550..ca32c18251 100644
--- a/pkg/function/export_rds_snapshot_location.go
+++ b/pkg/function/export_rds_snapshot_location.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -435,6 +436,8 @@ func postgresBackupCommand(dbEndpoint, username, password string, dbList []strin
 		return nil, errkit.New("No database found to backup")
 	}
 
+	profileQuoted := strconv.Quote(string(profile))
+
 	command := []string{
 		"bash",
 		"-o",
@@ -452,9 +455,9 @@ func postgresBackupCommand(dbEndpoint, username, password string, dbList []strin
 			for db in "${dblist[@]}";
 			  do echo "backing up $db db" && pg_dump $db -C --inserts > /backup/$db.sql;
 			done
-			tar -zc backup | kando location push --profile '%s' --path "${BACKUP_PREFIX}/${BACKUP_ID}" -
+			tar -zc backup | kando location push --profile %s --path "${BACKUP_PREFIX}/${BACKUP_ID}" -
 			kando output %s ${BACKUP_ID}`,
-			dbEndpoint, backupPrefix, backupID, strings.Join(dbList, " "), profile, ExportRDSSnapshotToLocBackupID),
+			dbEndpoint, backupPrefix, backupID, strings.Join(dbList, " "), profileQuoted, ExportRDSSnapshotToLocBackupID),
 	}
 	return command, nil
 }
diff --git a/pkg/function/rds_functions_test.go b/pkg/function/rds_functions_test.go
index fc037e6749..f278369a05 100644
--- a/pkg/function/rds_functions_test.go
+++ b/pkg/function/rds_functions_test.go
@@ -60,10 +60,32 @@ func (s *RDSFunctionsTest) TestPrepareCommand(c *check.C) {
 			command: []string{"bash", "-o", "errexit", "-o", "pipefail", "-c",
 				fmt.Sprintf(`
 		export PGHOST=%s
-		kando location pull --profile '%s' --path "%s" - | gunzip -c -f | sed 's/"LOCALE"/"LC_COLLATE"/' | psql -q -U "${PGUSER}" %s
+		kando location pull --profile "%s" --path "%s" - | gunzip -c -f | sed 's/"LOCALE"/"LC_COLLATE"/' | psql -q -U "${PGUSER}" %s
 		`, "db-endpoint", "null", fmt.Sprintf("%s/%s", "/backup/postgres-backup", "backup-id"), postgres.DefaultConnectDatabase),
 			},
 		},
+		{
+			name:            "PostgreS restore command with profile",
+			dbEngine:        PostgrSQLEngine,
+			action:          RestoreAction,
+			dbEndpoint:      "db-endpoint",
+			username:        "test-user",
+			password:        "secret-pass",
+			backupPrefix:    "/backup/postgres-backup",
+			backupID:        "backup-id",
+			dbEngineVersion: "12.7",
+			errChecker:      check.IsNil,
+			dbList:          []string{"template1"},
+			command: []string{"bash", "-o", "errexit", "-o", "pipefail", "-c",
+				fmt.Sprintf(`
+		export PGHOST=%s
+		kando location pull --profile "{\"Location\":{\"type\":\"\",\"bucket\":\"\",\"endpoint\":\"\",\"prefix\":\"\",\"region\":\"\"},\"Credential\":{\"Type\":\"\",\"KeyPair\":null,\"Secret\":null,\"KopiaServerSecret\":null},\"SkipSSLVerify\":false}" --path "%s" - | gunzip -c -f | sed 's/"LOCALE"/"LC_COLLATE"/' | psql -q -U "${PGUSER}" %s
+		`, "db-endpoint", fmt.Sprintf("%s/%s", "/backup/postgres-backup", "backup-id"), postgres.DefaultConnectDatabase),
+			},
+			tp: param.TemplateParams{
+				Profile: &param.Profile{},
+			},
+		},
 		{
 			name:            "PostgreS restore command",
 			dbEngine:        PostgrSQLEngine,
@@ -79,7 +101,7 @@ func (s *RDSFunctionsTest) TestPrepareCommand(c *check.C) {
 			command: []string{"bash", "-o", "errexit", "-o", "pipefail", "-c",
 				fmt.Sprintf(`
 		export PGHOST=%s
-		kando location pull --profile '%s' --path "%s" - | gunzip -c -f | psql -q -U "${PGUSER}" %s
+		kando location pull --profile "%s" --path "%s" - | gunzip -c -f | psql -q -U "${PGUSER}" %s
 		`, "db-endpoint", "null", fmt.Sprintf("%s/%s", "/backup/postgres-backup", "backup-id"), postgres.DefaultConnectDatabase),
 			},
 		},
@@ -106,7 +128,7 @@ func (s *RDSFunctionsTest) TestPrepareCommand(c *check.C) {
 			for db in "${dblist[@]}";
 			  do echo "backing up $db db" && pg_dump $db -C --inserts > /backup/$db.sql;
 			done
-			tar -zc backup | kando location push --profile '%s' --path "${BACKUP_PREFIX}/${BACKUP_ID}" -
+			tar -zc backup | kando location push --profile "%s" --path "${BACKUP_PREFIX}/${BACKUP_ID}" -
 			kando output %s ${BACKUP_ID}`,
 					"db-endpoint", "/backup/postgres-backup", "backup-id", strings.Join([]string{"template1"}, " "), "null", ExportRDSSnapshotToLocBackupID),
 			},
diff --git a/pkg/function/restore_rds_snapshot.go b/pkg/function/restore_rds_snapshot.go
index df5dd16957..76f482bfdd 100644
--- a/pkg/function/restore_rds_snapshot.go
+++ b/pkg/function/restore_rds_snapshot.go
@@ -17,6 +17,7 @@ package function
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -335,6 +336,8 @@ func postgresRestoreCommand(pgHost, username, password string, backupArtifactPre
 		replaceCommand = ` sed 's/"LOCALE"/"LC_COLLATE"/' |`
 	}
 
+	profileQuoted := strconv.Quote(string(profile))
+
 	return []string{
 		"bash",
 		"-o",
@@ -344,8 +347,8 @@ func postgresRestoreCommand(pgHost, username, password string, backupArtifactPre
 		"-c",
 		fmt.Sprintf(`
 		export PGHOST=%s
-		kando location pull --profile '%s' --path "%s" - | gunzip -c -f |%s psql -q -U "${PGUSER}" %s
-		`, pgHost, profile, fmt.Sprintf("%s/%s", backupArtifactPrefix, backupID), replaceCommand, postgres.DefaultConnectDatabase),
+		kando location pull --profile %s --path "%s" - | gunzip -c -f |%s psql -q -U "${PGUSER}" %s
+		`, pgHost, profileQuoted, fmt.Sprintf("%s/%s", backupArtifactPrefix, backupID), replaceCommand, postgres.DefaultConnectDatabase),
 	}, nil
 }
 
diff --git a/pkg/kube/pod_test.go b/pkg/kube/pod_test.go
index e88467d780..e14878821b 100644
--- a/pkg/kube/pod_test.go
+++ b/pkg/kube/pod_test.go
@@ -1246,13 +1246,14 @@ func (s *PodSuite) TestAddAnnotations(c *check.C) {
 	}
 }
 
-func (s *PodSuite) TestSomething(c *check.C) {
+// TestErrkitApiErrorsWrapping verifies that apierrors wrapped with errkit.Wrap are still matchable using apierrors matchers
+func (s *PodSuite) TestErrkitApiErrorsWrapping(c *check.C) {
 	// Create the fake client
 	fakeClient := fake.NewSimpleClientset()
 
 	// Add a reactor to simulate an error when trying to get a PVC
 	fakeClient.PrependReactor("get", "persistentvolumeclaims", func(action testing.Action) (handled bool, ret runtime.Object, err error) {
-		return true, nil, apierrors.NewNotFound(action.GetResource().GroupResource(), action.GetSubresource())
+		return true, nil, errkit.Wrap(apierrors.NewNotFound(action.GetResource().GroupResource(), action.GetSubresource()), "Some context")
 	})
 
 	_, err := fakeClient.CoreV1().PersistentVolumeClaims("abc").Get(context.TODO(), "def", metav1.GetOptions{})
diff --git a/pkg/objectstore/directory.go b/pkg/objectstore/directory.go
index 0cf97c9c14..4598eb8ab7 100644
--- a/pkg/objectstore/directory.go
+++ b/pkg/objectstore/directory.go
@@ -234,7 +234,7 @@ func (d *directory) Put(ctx context.Context, name string, r io.Reader, size int6
 	if d.path == "" {
 		return errkit.New("invalid entry")
 	}
-	// K10 tags include '/'. Remove them, at least for S3
+	// Replace any '/' in tags with '-'.
 	sTags := sanitizeTags(tags)
 
 	objName := d.absPathName(name)