How do I change or add S3 credentials, when a S3 special remote is already initialised/enabled?

I have a repository with a `public=yes` S3 remote, such that people can read the data without credentials.
But then when they need to upload files, how do they add their credentials?

Setting the `AWS_*` environment variables when running `git annex copy --to=s3` works, but then the credentials are not stored.