diff --git a/CHANGELOG b/CHANGELOG
index 1fda614aa9..46fc1d4470 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,8 @@ git-annex (10.20241032) UNRELEASED; urgency=medium
   * git-remote-annex: Fix a reversion introduced in version 10.20241031
     that broke cloning from a special remote.
   * vpop: Only update state after successful checkout.
+  * S3: Support versioning=yes with a readonly bucket.
+    (Needs aws-0.24.3)
 
  -- Joey Hess <id@joeyh.name>  Mon, 11 Nov 2024 12:26:00 -0400
 
diff --git a/Remote/S3.hs b/Remote/S3.hs
index b37e60543c..f73e494531 100644
--- a/Remote/S3.hs
+++ b/Remote/S3.hs
@@ -1341,11 +1341,24 @@ enableBucketVersioning ss info _ _ _ = do
   where
 	enableversioning b = do
 #if MIN_VERSION_aws(0,21,1)
-		showAction "enabling bucket versioning"
+		showAction "checking bucket versioning"
 		hdl <- mkS3HandleVar c gc u
+		let setversioning = S3.putBucketVersioning b S3.VersioningEnabled
 		withS3HandleOrFail u hdl $ \h ->
-			void $ liftIO $ runResourceT $ sendS3Handle h $
-				S3.putBucketVersioning b S3.VersioningEnabled
+#if MIN_VERSION_aws(0,24,3)
+			liftIO $ runResourceT $
+				tryS3 (sendS3Handle h setversioning) >>= \case
+					Right _ -> return ()
+					Left err -> do
+						res <- sendS3Handle h $
+							S3.getBucketVersioning b
+						case S3.gbvVersioning res of
+							Just S3.VersioningEnabled -> return ()
+							_ -> giveup $ "This bucket does not have versioning enabled, and enabling it failed: "
+								++ T.unpack (S3.s3ErrorMessage err)
+#else
+			void $ liftIO $ runResourceT $ sendS3Handle h go
+#endif
 #else
 		showLongNote $ unlines
 			[ "This version of git-annex cannot auto-enable S3 bucket versioning."
diff --git a/stack.yaml b/stack.yaml
index 7c8dfb39cc..4ca2a3c683 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -16,3 +16,4 @@ packages:
 resolver: nightly-2024-07-29
 extra-deps:
 - filepath-bytestring-1.4.100.3.2
+- aws-0.24.3