How do I change or add S3 credentials, when a S3 special remote is already initialised/enabled?

I have a repository with a public=yes S3 remote, such that people can read the data without credentials. But then when they need to upload files, how do they add their credentials?

Setting the AWS_* environment variables when running git annex copy --to=s3 works, but then the credentials are not stored.