diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 6d12d9fbb6..cbdbed26f4 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-7842807b641e25c6683f92c385f294c29f33c197
\ No newline at end of file
+e8605e72a6c93c9cf43737ebea74dd28e1f00e83
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index f013db7338..e183c44e22 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -2263,6 +2263,7 @@ async fn upload_s3_file_from_app(
                     );
                     let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                         &db_with_opt_authed,
+                        Some(&on_behalf_authed),
                         &w_id,
                         None,
                         &[(&file_key, S3Permission::WRITE)],
@@ -2294,6 +2295,7 @@ async fn upload_s3_file_from_app(
                 DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
             let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                 &db_with_opt_authed,
+                Some(&on_behalf_authed),
                 &w_id,
                 None,
                 &[(&file_key, S3Permission::WRITE)],
@@ -2333,6 +2335,7 @@ async fn upload_s3_file_from_app(
                 let db_with_opt_authed = DbWithOptAuthed::from_authed(&authed, db.clone(), None);
                 let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
                     &db_with_opt_authed,
+                Some(&authed),
                     &w_id,
                     None,
                     &[(&file_key, S3Permission::WRITE)],
@@ -2443,6 +2446,7 @@ async fn delete_s3_file_from_app(
         let db_with_opt_authed = DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
         let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
             &db_with_opt_authed,
+                Some(&on_behalf_authed),
             &w_id,
             None,
             &[(&path.to_string(), S3Permission::DELETE)],
diff --git a/backend/windmill-common/src/db.rs b/backend/windmill-common/src/db.rs
index 99c4b893dc..cf938504d3 100644
--- a/backend/windmill-common/src/db.rs
+++ b/backend/windmill-common/src/db.rs
@@ -148,6 +148,13 @@ impl<'a, T: Authable + Sync> DbWithOptAuthed<'a, T> {
             DbWithOptAuthed::DB { .. } => None,
         }
     }
+
+    pub fn audit_author(&self) -> Option<&AuditAuthor> {
+        match self {
+            DbWithOptAuthed::UserDB { .. } => None,
+            DbWithOptAuthed::DB { audit_author, .. } => Some(audit_author),
+        }
+    }
 }
 
 impl<'c, 'd, T: Authable + Sync> Acquire<'c> for &'c DbWithOptAuthed<'d, T> {