diff --git a/stdlib/aws/aws.cue b/stdlib/aws/aws.cue
index f0f65d07..9a3be0ff 100644
--- a/stdlib/aws/aws.cue
+++ b/stdlib/aws/aws.cue
@@ -9,11 +9,11 @@ import (
 // Base AWS Config
 #Config: {
 	// AWS region
-	region: string
+	region: string @dagger(input)
 	// AWS access key
-	accessKey: dagger.#Secret
+	accessKey: dagger.#Secret @dagger(input)
 	// AWS secret key
-	secretKey: dagger.#Secret
+	secretKey: dagger.#Secret @dagger(input)
 }
 
 // Re-usable aws-cli component
diff --git a/stdlib/aws/s3/s3.cue b/stdlib/aws/s3/s3.cue
index c3c1cf57..306f2b9e 100644
--- a/stdlib/aws/s3/s3.cue
+++ b/stdlib/aws/s3/s3.cue
@@ -9,25 +9,25 @@ import (
 #Put: {
 
 	// AWS Config
-	config: aws.#Config
+	config: aws.#Config @dagger(input)
 
 	// Source Artifact to upload to S3
-	source?: dagger.#Artifact
+	source?: dagger.#Artifact @dagger(input)
 
 	// Source inlined as a string to upload to S3
-	sourceInline?: string
+	sourceInline?: string @dagger(input)
 
 	// Target S3 URL (eg. s3://<bucket-name>/<path>/<sub-path>)
-	target: string
+	target: string @dagger(input)
 
 	// Object content type
-	contentType: string | *""
+	contentType: string | *"" @dagger(input)
 
 	// URL of the uploaded S3 object
-	url: out
+	url: out @dagger(output)
 
 	// Always write the object to S3
-	always?: bool
+	always?: bool @dagger(input)
 
 	out: string
 	aws.#Script & {
diff --git a/stdlib/dagger/dagger.cue b/stdlib/dagger/dagger.cue
index 39128169..ff67e740 100644
--- a/stdlib/dagger/dagger.cue
+++ b/stdlib/dagger/dagger.cue
@@ -7,7 +7,9 @@ import (
 // An artifact such as source code checkout, container image, binary archive...
 // May be passed as user input, or computed by a buildkit pipeline
 
+// FIXME (perf). See https://github.com/dagger/dagger/issues/445
 #Artifact: {
+	@dagger(artifact)
 	#up: [...op.#Op]
 	_
 	...
@@ -17,5 +19,6 @@ import (
 // FIXME: currently aliased as a string to mark secrets
 // this requires proper support.
 #Secret: {
+	@dagger(secret)
 	string | bytes
 }