diff --git a/Readme.md b/Readme.md
index dc48eb9..af59d10 100644
--- a/Readme.md
+++ b/Readme.md
@@ -74,6 +74,8 @@ If that project has `AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`,
 
 If that same project also has `AWS_MFA_SERIAL`, startup asks for an MFA code before the assume. The serial stays in Portunus. The code is typed each time. A different project or stage can omit any of these variables.
 
+Without `AWS_ROLE_TO_ASSUME`, a project that has `AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_MFA_SERIAL` also asks for an MFA code at startup. The session token is written to `~/.aws/credentials` and exported in the shell, the same as running `mfa <code>` yourself.
+
 `dev` with no project does not load Portunus, so that container does not assume a role. Keys without `AWS_ROLE_TO_ASSUME` still configure the default profile as the IAM user.
 
 ## AWS MFA
diff --git a/script.sh b/script.sh
index 6fcea9c..3e85c12 100644
--- a/script.sh
+++ b/script.sh
@@ -98,6 +98,22 @@ EOF
             aws configure set region "$AWS_REGION" || error_exit "Failed to set AWS region: ${AWS_REGION}"
             aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" || error_exit "Failed to set AWS access key."
             aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" || error_exit "Failed to set AWS secret access key."
+            # No role to assume, so the IAM user itself needs the MFA session. mfa.sh writes it
+            # to the credentials file and exports it, and the shell opened below inherits it.
+            if [ -n "${AWS_MFA_SERIAL:-}" ]; then
+                echo "MFA is required for this project."
+                if [ -r /dev/tty ] && [ -w /dev/tty ]; then
+                    printf 'MFA code: ' >/dev/tty
+                    IFS= read -r mfa_code </dev/tty || error_exit "AWS_MFA_SERIAL is set for this project, but the MFA code could not be read."
+                else
+                    printf 'MFA code: ' >&2
+                    IFS= read -r mfa_code || error_exit "AWS_MFA_SERIAL is set for this project, but there is no terminal to read an MFA code."
+                fi
+                if [ -z "${mfa_code}" ]; then
+                    error_exit "An MFA code is required for this project."
+                fi
+                source /usr/local/bin/mfa.sh "$mfa_code" || error_exit "Failed to create an MFA session."
+            fi
         fi
     elif [ -n "${AWS_ROLE_TO_ASSUME:-}" ]; then
         error_exit "AWS_ROLE_TO_ASSUME is set, but AWS_REGION, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY are required to assume it."