diff --git a/CHANGELOG.md b/CHANGELOG.md
index 844df4d0fa..ad34f18d2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.4.23] - 07/15/2025
+
+## [1.4.22] - 07/02/2025
+
 ## [1.4.21] - 06/27/2025
 
 ## [1.4.20] - 06/20/2025
diff --git a/codegen/smithy-kotlin-codegen/src/main/kotlin/software/amazon/smithy/kotlin/codegen/core/RuntimeTypes.kt b/codegen/smithy-kotlin-codegen/src/main/kotlin/software/amazon/smithy/kotlin/codegen/core/RuntimeTypes.kt
index 85b20e4dad..80658e75cf 100644
--- a/codegen/smithy-kotlin-codegen/src/main/kotlin/software/amazon/smithy/kotlin/codegen/core/RuntimeTypes.kt
+++ b/codegen/smithy-kotlin-codegen/src/main/kotlin/software/amazon/smithy/kotlin/codegen/core/RuntimeTypes.kt
@@ -380,6 +380,9 @@ object RuntimeTypes {
             val BearerTokenProviderConfig = symbol("BearerTokenProviderConfig")
             val BearerTokenProvider = symbol("BearerTokenProvider")
 
+            val BearerToken = symbol("BearerToken")
+            val EnvironmentBearerTokenProvider = symbol("EnvironmentBearerTokenProvider")
+
             val reprioritizeAuthOptions = symbol("reprioritizeAuthOptions")
         }
 
diff --git a/gradle.properties b/gradle.properties
index eb1c5a632e..8e71bdc0c8 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -13,8 +13,10 @@ kotlinx.atomicfu.enableNativeIrTransformation=false
 org.gradle.jvmargs=-Xmx2G -XX:MaxMetaspaceSize=1G
 
 # SDK
-sdkVersion=1.5.0-SNAPSHOT
-codegenVersion=0.35.0-SNAPSHOT
+sdkVersion=1.4.24-SNAPSHOT
+
+# codegen
+codegenVersion=0.34.24-SNAPSHOT
 
 # FIXME Remove after Dokka 2.0 Gradle plugin is stable
 org.jetbrains.dokka.experimental.gradle.pluginMode=V2Enabled
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index e6b5877dcd..3ef5eb2d53 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -2,7 +2,7 @@
 kotlin-version = "2.2.0"
 dokka-version = "2.0.0"
 
-aws-kotlin-repo-tools-version = "0.4.31"
+aws-kotlin-repo-tools-version = "0.4.32"
 
 # libs
 coroutines-version = "1.10.2"
@@ -13,10 +13,11 @@ okio-version = "3.15.0"
 otel-version = "1.45.0"
 slf4j-version = "2.0.16"
 slf4j-v1x-version = "1.7.36"
-crt-kotlin-version = "0.9.2"
+crt-kotlin-version = "0.10.0"
 micrometer-version = "1.14.2"
 binary-compatibility-validator-version = "0.18.0"
 
+# codegen
 smithy-version = "1.60.2"
 
 # testing
diff --git a/runtime/auth/http-auth/api/http-auth.api b/runtime/auth/http-auth/api/http-auth.api
index 709166a395..d47a5a9c79 100644
--- a/runtime/auth/http-auth/api/http-auth.api
+++ b/runtime/auth/http-auth/api/http-auth.api
@@ -59,6 +59,12 @@ public final class aws/smithy/kotlin/runtime/http/auth/BearerTokenSigner : aws/s
 public abstract interface class aws/smithy/kotlin/runtime/http/auth/CloseableBearerTokenProvider : aws/smithy/kotlin/runtime/http/auth/BearerTokenProvider, java/io/Closeable {
 }
 
+public final class aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProvider : aws/smithy/kotlin/runtime/http/auth/BearerTokenProvider {
+	public fun <init> (Ljava/lang/String;Laws/smithy/kotlin/runtime/util/PlatformProvider;)V
+	public synthetic fun <init> (Ljava/lang/String;Laws/smithy/kotlin/runtime/util/PlatformProvider;ILkotlin/jvm/internal/DefaultConstructorMarker;)V
+	public fun resolve (Laws/smithy/kotlin/runtime/collections/Attributes;Lkotlin/coroutines/Continuation;)Ljava/lang/Object;
+}
+
 public final class aws/smithy/kotlin/runtime/http/auth/ReprioritizeAuthOptionsKt {
 	public static final fun reprioritizeAuthOptions (Ljava/util/List;Ljava/util/List;)Ljava/util/List;
 }
diff --git a/runtime/auth/http-auth/common/src/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProvider.kt b/runtime/auth/http-auth/common/src/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProvider.kt
new file mode 100644
index 0000000000..ffe37b60b0
--- /dev/null
+++ b/runtime/auth/http-auth/common/src/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProvider.kt
@@ -0,0 +1,29 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package aws.smithy.kotlin.runtime.http.auth
+
+import aws.smithy.kotlin.runtime.collections.Attributes
+import aws.smithy.kotlin.runtime.collections.emptyAttributes
+import aws.smithy.kotlin.runtime.time.Instant
+import aws.smithy.kotlin.runtime.util.PlatformProvider
+
+/**
+ * A [BearerTokenProvider] that extracts the bearer token from the target environment variable.
+ */
+public class EnvironmentBearerTokenProvider(
+    private val key: String,
+    private val platform: PlatformProvider = PlatformProvider.System,
+) : BearerTokenProvider {
+    override suspend fun resolve(attributes: Attributes): BearerToken {
+        val bearerToken = platform.getenv(key)
+            ?: error("$key environment variable is not set")
+
+        return object : BearerToken {
+            override val token: String = bearerToken
+            override val attributes: Attributes = emptyAttributes()
+            override val expiration: Instant? = null
+        }
+    }
+}
diff --git a/runtime/auth/http-auth/common/test/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProviderTest.kt b/runtime/auth/http-auth/common/test/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProviderTest.kt
new file mode 100644
index 0000000000..e98e8083d5
--- /dev/null
+++ b/runtime/auth/http-auth/common/test/aws/smithy/kotlin/runtime/http/auth/EnvironmentBearerTokenProviderTest.kt
@@ -0,0 +1,35 @@
+package aws.smithy.kotlin.runtime.http.auth
+
+import aws.smithy.kotlin.runtime.collections.emptyAttributes
+import aws.smithy.kotlin.runtime.util.TestPlatformProvider
+import kotlinx.coroutines.test.runTest
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+
+class EnvironmentBearerTokenProviderTest {
+    @Test
+    fun testResolveWithValidToken() = runTest {
+        val provider = EnvironmentBearerTokenProvider(
+            "TEST_TOKEN",
+            TestPlatformProvider(mutableMapOf("TEST_TOKEN" to "test-bearer-token")),
+        )
+
+        val token = provider.resolve()
+
+        assertEquals("test-bearer-token", token.token)
+    }
+
+    @Test
+    fun testResolveWithMissingToken() = runTest {
+        val provider = EnvironmentBearerTokenProvider(
+            "MISSING_TEST_TOKEN",
+            TestPlatformProvider(mutableMapOf()),
+        )
+
+        val exception = assertFailsWith<IllegalStateException> {
+            provider.resolve(emptyAttributes())
+        }
+        assertEquals("MISSING_TEST_TOKEN environment variable is not set", exception.message)
+    }
+}
diff --git a/runtime/build.gradle.kts b/runtime/build.gradle.kts
index de5fd30f5b..9da74f02a8 100644
--- a/runtime/build.gradle.kts
+++ b/runtime/build.gradle.kts
@@ -4,6 +4,7 @@
  */
 import aws.sdk.kotlin.gradle.dsl.configurePublishing
 import aws.sdk.kotlin.gradle.kmp.*
+import org.gradle.kotlin.dsl.apply
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
 plugins {