diff --git a/src/main/environment/common_docker.properties b/src/main/environment/common_docker.properties
index be5f3608..d5c20698 100644
--- a/src/main/environment/common_docker.properties
+++ b/src/main/environment/common_docker.properties
@@ -6,10 +6,10 @@ spring.datasource.password=${DATABASE_PASSWORD}
 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
 
 ## S3 storage for diagnostic documents pushed from a van
-aws.s3.access-key=${AWS_S3_ACCESS_KEY}
-aws.s3.secret-key=${AWS_S3_SECRET_KEY}
-aws.s3.region=${AWS_S3_REGION}
-diagnostic.documents.s3.bucket=${DIAGNOSTIC_DOCUMENTS_S3_BUCKET}
+aws.s3.access-key=${AWS_S3_ACCESS_KEY:}
+aws.s3.secret-key=${AWS_S3_SECRET_KEY:}
+aws.s3.region=${AWS_S3_REGION:ap-south-1}
+diagnostic.documents.s3.bucket=${DIAGNOSTIC_DOCUMENTS_S3_BUCKET:}
 
 ## Carestream URLs, local
 carestreamOrderCreateURL=${COMMON_API}carestream/createOrder
@@ -36,7 +36,7 @@ dataSyncDownloadUrl=${MMU_CENTRAL_SERVER}dataSync/server-to-van
 
 ## Diagnostic document push (this server -> further central server)
 diagnosticDocumentUploadUrl=${MMU_CENTRAL_SERVER}dataSync/diagnostic-documents
-diagnosticDocument.push.batchSize=${DIAGNOSTIC_DOCUMENT_PUSH_BATCH_SIZE}
+diagnosticDocument.push.batchSize=${DIAGNOSTIC_DOCUMENT_PUSH_BATCH_SIZE:3}
 diagnostic.documents.storage-root=${DIAGNOSTIC_DOCUMENTS_STORAGE_ROOT}
 
 ## TC specialist slot booking, # not required
diff --git a/src/main/java/com/iemr/mmu/config/S3ClientConfig.java b/src/main/java/com/iemr/mmu/config/S3ClientConfig.java
index af02dcbb..eb3509bf 100644
--- a/src/main/java/com/iemr/mmu/config/S3ClientConfig.java
+++ b/src/main/java/com/iemr/mmu/config/S3ClientConfig.java
@@ -5,6 +5,8 @@
 import org.springframework.context.annotation.Configuration;
 
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
+import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
+import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
 import software.amazon.awssdk.regions.Region;
 import software.amazon.awssdk.services.s3.S3Client;
@@ -26,7 +28,16 @@ public class S3ClientConfig {
 	@Value("${aws.s3.region}")
 	private String region;
 
-	private StaticCredentialsProvider credentialsProvider() {
+	/*
+	 * Only the central server talks to S3; a van (camp laptop) runs the same war but never
+	 * calls it, so it must be able to start without AWS keys. AwsBasicCredentials rejects blank
+	 * keys at construction time, so fall back to the SDK default chain, which is resolved lazily
+	 * on the first S3 call rather than at startup.
+	 */
+	private AwsCredentialsProvider credentialsProvider() {
+		if (accessKey == null || accessKey.isBlank() || secretKey == null || secretKey.isBlank()) {
+			return DefaultCredentialsProvider.create();
+		}
 		return StaticCredentialsProvider.create(AwsBasicCredentials.create(accessKey, secretKey));
 	}