diff --git a/src/content/docs/aws/services/cloudfront.mdx b/src/content/docs/aws/services/cloudfront.mdx
index 8b24cd0e..a6564fae 100644
--- a/src/content/docs/aws/services/cloudfront.mdx
+++ b/src/content/docs/aws/services/cloudfront.mdx
@@ -83,7 +83,7 @@ function handler(event) {
 Create the function with [`CreateFunction`](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFunction.html):
 
 ```bash
-awslocal cloudfront create-function \
+lstk aws cloudfront create-function \
     --name stamp-env \
     --function-code fileb://stamp-env.js \
     --function-config 'Comment=stamp the environment,Runtime=cloudfront-js-2.0'
@@ -135,7 +135,7 @@ Write the event object to a file:
 Pass the ETag returned by `create-function` as `--if-match`:
 
 ```bash
-awslocal cloudfront test-function \
+lstk aws cloudfront test-function \
     --name stamp-env \
     --if-match 54ddd071 \
     --event-object fileb://event.json \
@@ -173,7 +173,7 @@ Use it for debugging, but do not assert on it in tests.
 [`PublishFunction`](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_PublishFunction.html) marks the function ready to associate with a distribution:
 
 ```bash
-awslocal cloudfront publish-function --name stamp-env --if-match 54ddd071
+lstk aws cloudfront publish-function --name stamp-env --if-match 54ddd071
 ```
 
 ```bash title="Output"
@@ -282,7 +282,7 @@ On a plan without the data plane you can create a store and associate it with a
 Create a store with [`CreateKeyValueStore`](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateKeyValueStore.html):
 
 ```bash
-awslocal cloudfront create-key-value-store \
+lstk aws cloudfront create-key-value-store \
     --name tenant-map \
     --comment "tenant to environment"
 ```
@@ -317,7 +317,7 @@ Control-plane commands are unaffected.
 :::
 
 :::tip
-When you use `awslocal`, install the AWS Common Runtime once with `pip install 'botocore[crt]'`.
+When you use `lstk aws`, install the AWS Common Runtime once with `pip install 'botocore[crt]'`.
 These requests are signed with SigV4A, which a `pip`-installed AWS CLI cannot sign without it.
 :::
 
@@ -332,7 +332,7 @@ Writes require the current ETag in `--if-match`.
 Read it from the data plane with [`DescribeKeyValueStore`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_DescribeKeyValueStore.html):
 
 ```bash
-awslocal cloudfront-keyvaluestore describe-key-value-store --kvs-arn "$KVS_ARN"
+lstk aws cloudfront-keyvaluestore describe-key-value-store --kvs-arn "$KVS_ARN"
 ```
 
 ```bash title="Output"
@@ -350,7 +350,7 @@ awslocal cloudfront-keyvaluestore describe-key-value-store --kvs-arn "$KVS_ARN"
 Write several keys at once with [`UpdateKeys`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_UpdateKeys.html), which also accepts `--deletes`:
 
 ```bash
-awslocal cloudfront-keyvaluestore update-keys \
+lstk aws cloudfront-keyvaluestore update-keys \
     --kvs-arn "$KVS_ARN" \
     --if-match 02CDEC9C \
     --puts 'Key=tenant-a.example.com,Value=prod' 'Key=tenant-b.example.com,Value=prod-sand'
@@ -369,7 +369,7 @@ awslocal cloudfront-keyvaluestore update-keys \
 List the contents with [`ListKeys`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_ListKeys.html):
 
 ```bash
-awslocal cloudfront-keyvaluestore list-keys --kvs-arn "$KVS_ARN"
+lstk aws cloudfront-keyvaluestore list-keys --kvs-arn "$KVS_ARN"
 ```
 
 ```bash title="Output"
@@ -390,7 +390,7 @@ awslocal cloudfront-keyvaluestore list-keys --kvs-arn "$KVS_ARN"
 Single keys are handled with [`PutKey`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_PutKey.html), [`GetKey`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_GetKey.html) and [`DeleteKey`](https://docs.aws.amazon.com/cloudfront-keyvaluestore/latest/APIReference/API_DeleteKey.html):
 
 ```bash
-awslocal cloudfront-keyvaluestore get-key --kvs-arn "$KVS_ARN" --key tenant-a.example.com
+lstk aws cloudfront-keyvaluestore get-key --kvs-arn "$KVS_ARN" --key tenant-a.example.com
 ```
 
 ```bash title="Output"
@@ -441,7 +441,7 @@ Concurrency and lookup failures surface as follows:
 Associate the store when you create the function, through `KeyValueStoreAssociations`:
 
 ```bash
-awslocal cloudfront create-function \
+lstk aws cloudfront create-function \
     --name tenant-router \
     --function-code fileb://tenant-router.js \
     --function-config "Comment=tenant pre-router,Runtime=cloudfront-js-2.0,KeyValueStoreAssociations={Quantity=1,Items=[{KeyValueStoreARN=$KVS_ARN}]}"
@@ -553,19 +553,19 @@ async function handler(event) {
 Create the function with the store associated, then publish it:
 
 ```bash
-export FUNCTION_ETAG=$(awslocal cloudfront create-function \
+export FUNCTION_ETAG=$(lstk aws cloudfront create-function \
     --name tenant-router \
     --function-code fileb://tenant-router.js \
     --function-config "Comment=tenant pre-router,Runtime=cloudfront-js-2.0,KeyValueStoreAssociations={Quantity=1,Items=[{KeyValueStoreARN=$KVS_ARN}]}" \
     --query ETag --output text)
-awslocal cloudfront publish-function --name tenant-router --if-match "$FUNCTION_ETAG"
+lstk aws cloudfront publish-function --name tenant-router --if-match "$FUNCTION_ETAG"
 ```
 
 Confirm the routing decision with `test-function` before wiring up a distribution.
 With `host` set to `tenant-b.example.com` in `event.json`, the function resolves the tenant through the store:
 
 ```bash
-awslocal cloudfront test-function \
+lstk aws cloudfront test-function \
     --name tenant-router \
     --if-match "$FUNCTION_ETAG" \
     --event-object fileb://event.json \
@@ -621,7 +621,7 @@ To exercise the same path over a real request, create a distribution that lists
 ```
 
 ```bash
-awslocal cloudfront create-distribution \
+lstk aws cloudfront create-distribution \
     --distribution-config file://distribution-config.json \
     --query '{Id:Distribution.Id,DomainName:Distribution.DomainName}'
 ```
diff --git a/src/content/docs/aws/services/elb.mdx b/src/content/docs/aws/services/elb.mdx
index 01dfc911..e0502e0e 100644
--- a/src/content/docs/aws/services/elb.mdx
+++ b/src/content/docs/aws/services/elb.mdx
@@ -190,19 +190,19 @@ The following example uses the `subnet_id` variable set in the [Getting started]
 
 ```bash
 # Create the load balancer
-loadBalancer=$(awslocal elbv2 create-load-balancer \
+loadBalancer=$(lstk aws elbv2 create-load-balancer \
     --name multi-listener-lb \
     --subnets $subnet_id | jq -r '.LoadBalancers[].LoadBalancerArn')
 
 # Listener on port 80
-awslocal elbv2 create-listener \
+lstk aws elbv2 create-listener \
     --load-balancer-arn $loadBalancer \
     --protocol HTTP \
     --port 80 \
     --default-actions '{"Type":"fixed-response","FixedResponseConfig":{"StatusCode":"200","MessageBody":"Listener 80","ContentType":"text/plain"}}'
 
 # Listener on port 8080
-awslocal elbv2 create-listener \
+lstk aws elbv2 create-listener \
     --load-balancer-arn $loadBalancer \
     --protocol HTTP \
     --port 8080 \
diff --git a/src/content/docs/aws/services/lambda.mdx b/src/content/docs/aws/services/lambda.mdx
index 900a3143..d045cfd8 100644
--- a/src/content/docs/aws/services/lambda.mdx
+++ b/src/content/docs/aws/services/lambda.mdx
@@ -548,7 +548,7 @@ export const handler = withDurableExecution(async (event, context) => {
 Create the function with a five-minute execution timeout and seven-day retention period:
 
 ```bash
-awslocal lambda create-function \
+lstk aws lambda create-function \
   --function-name durable-hello \
   --runtime nodejs22.x \
   --handler index.handler \
@@ -574,7 +574,7 @@ awslocal lambda create-function \
 Wait for the function to become active:
 
 ```bash
-awslocal lambda wait function-active-v2 --function-name durable-hello
+lstk aws lambda wait function-active-v2 --function-name durable-hello
 ```
 
 Create `event.json`:
@@ -589,7 +589,7 @@ Start an asynchronous durable execution.
 Use a qualified function target and a durable execution name, which acts as an idempotency key:
 
 ```bash
-EXECUTION_ARN=$(awslocal lambda invoke \
+EXECUTION_ARN=$(lstk aws lambda invoke \
   --function-name durable-hello \
   --qualifier '$LATEST' \
   --invocation-type Event \
@@ -607,7 +607,7 @@ arn:aws:lambda:us-east-1:000000000000:function:durable-hello:$LATEST/durable-exe
 After the execution finishes, retrieve its status and result:
 
 ```bash
-awslocal lambda get-durable-execution \
+lstk aws lambda get-durable-execution \
   --durable-execution-arn "$EXECUTION_ARN" \
   --query '{DurableExecutionName:DurableExecutionName,Status:Status,Result:Result,DurableConfig:DurableConfig}'
 ```
@@ -627,7 +627,7 @@ awslocal lambda get-durable-execution \
 Inspect the execution history to see the checkpoint, suspension, replay, and completion:
 
 ```bash
-awslocal lambda get-durable-execution-history \
+lstk aws lambda get-durable-execution-history \
   --durable-execution-arn "$EXECUTION_ARN" \
   --query 'Events[].EventType'
 ```
diff --git a/src/content/docs/aws/services/s3.mdx b/src/content/docs/aws/services/s3.mdx
index 3b1d9e64..0653d002 100644
--- a/src/content/docs/aws/services/s3.mdx
+++ b/src/content/docs/aws/services/s3.mdx
@@ -227,7 +227,7 @@ The following credentials pass validation:
 For example, after [creating a role](/aws/services/sts/#create-an-iam-role), you can retrieve temporary credentials for it using the `AssumeRole` API:
 
 ```bash
-awslocal sts assume-role \
+lstk aws sts assume-role \
     --role-arn arn:aws:iam::000000000000:role/localstack-role \
     --role-session-name localstack-session
 ```
@@ -251,7 +251,7 @@ export AWS_ACCESS_KEY_ID=ACCESS_KEY_ID
 export AWS_SECRET_ACCESS_KEY=SECRET_ACCESS_KEY
 export AWS_SESSION_TOKEN=SESSION_TOKEN
 
-awslocal s3api list-buckets
+lstk aws s3api list-buckets
 ```
 
 :::note