diff --git a/controlplane/provisioner/trino_provisioner.go b/controlplane/provisioner/trino_provisioner.go
index 3e8de24b..7eef4b64 100644
--- a/controlplane/provisioner/trino_provisioner.go
+++ b/controlplane/provisioner/trino_provisioner.go
@@ -955,11 +955,14 @@ func (p *TrinoProvisioner) reconcileCatalogs(ctx context.Context, orgs []configs
 // credentials are embedded here — just the endpoint, the warehouse
 // name, and the per-org S3 IAM role.
 //
-// Property names follow Trino's current file-system / Iceberg-REST
-// surface (matching the working maintenance chart at
-// charts/charts/trino/files/trino_maintenance.py):
+// Property names MUST stay in sync with the working maintenance chart at
+// charts/charts/trino/files/trino_maintenance.py — this set drifted from it
+// once (fs.s3.enabled vs fs.native-s3.enabled), which Trino 476 rejects at
+// CREATE CATALOG ("Configuration property 'fs.s3.enabled' was not used"):
 //
-//	fs.s3.enabled=true              enable the unified S3 file system
+//	fs.native-s3.enabled=true       enable Trino's native S3 file system
+//	                                (required since Trino 458; the legacy
+//	                                Hadoop fs.s3.* surface is rejected by 476)
 //	s3.region=<region>              forwarded to the AWS SDK
 //	s3.iam-role=<arn>               per-org duckling-<orgid> role
 //
@@ -974,7 +977,7 @@ func (p *TrinoProvisioner) buildCatalogProperties(orgID string, ic *configstore.
 		"iceberg.catalog.type":           "rest",
 		"iceberg.rest-catalog.uri":       ic.LakekeeperEndpoint,
 		"iceberg.rest-catalog.warehouse": ic.LakekeeperWarehouse,
-		"fs.s3.enabled":                  "true",
+		"fs.native-s3.enabled":           "true",
 	}
 	if p.iamAccountID != "" {
 		props["s3.iam-role"] = fmt.Sprintf("arn:aws:iam::%s:role/duckling-%s", p.iamAccountID, orgID)
diff --git a/controlplane/provisioner/trino_provisioner_test.go b/controlplane/provisioner/trino_provisioner_test.go
index c107b28c..abd86123 100644
--- a/controlplane/provisioner/trino_provisioner_test.go
+++ b/controlplane/provisioner/trino_provisioner_test.go
@@ -462,8 +462,8 @@ func TestReconcile_CreatesCatalogProjectsSecretAndConfigMap(t *testing.T) {
 	if !strings.Contains(props["s3.iam-role"], "duckling-42") {
 		t.Errorf("expected duckling-42 role ARN under s3.iam-role, got %q", props["s3.iam-role"])
 	}
-	if props["fs.s3.enabled"] != "true" {
-		t.Errorf("expected fs.s3.enabled=true, got %q", props["fs.s3.enabled"])
+	if props["fs.native-s3.enabled"] != "true" {
+		t.Errorf("expected fs.native-s3.enabled=true, got %q", props["fs.native-s3.enabled"])
 	}
 	// Old property names must NOT be emitted — they're silently ignored
 	// or rejected by current Trino.