aws_profile doesn't work with profiles stored in ~/.aws/config

I have an AWS profile declared in my ~/.aws/config file:

[profile myprofile]
credential_process = my_helper_process

I have AWS_SDK_LOAD_CONFIG=1 set.

I can do aws CLI commands with this profile:

$ aws sts get-caller-identity --profile=my-profile
{
    "Account": "<account>",
    "UserId": "<userid>",
    "Arn": "<arn>"
}

My SOPS file secrets.yaml has the contents:

sops:
    kms:
    -   arn: <arn>
        created_at: <created> 
        enc: <enc>
        aws_profile: "myprofile"

I do sops -i secrets.yaml and get the error:

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  <arn>: FAILED
    - | Error decrypting key: SharedCredsLoad: failed to get profile

Recovery failed because no master key was able to decrypt the file. In order for SOPS to recover the file, at least one key has to be successful, but none were.

Setting AWS_PROFILE=myprofile does work (but only if the aws_profile option is unset in secrets.yaml, which surprised and confused the heck out of me.)

Using the flag --aws-profile does not seem to work (regardless of the value of aws_profile).

The Usage field in --help does say "(you need valid credentials in ~/.aws/credentials or in your env)" however I feel that this is working rather inconsistently.

Our actual use case is to use the Terraform SOPS provider and for "reasons" we can't set the AWS_PROFILE variable (we're using it for other things). Ideally we just need aws_profile to correctly load our profile out of ~/.aws/config.

Reproduce the failure using the shown ~/.aws/config profile, secrets.yaml, and the sops -i command, then compare it with AWS_PROFILE behavior and the --aws-profile flag. Trace how aws_profile is passed into AWS credential loading and verify support for profiles defined in ~/.aws/config. Done means the named profile works without changing AWS_PROFILE and the relevant command paths behave consistently.