diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,13 @@
+### v0.2.0.2
+
+- Upgrade to newer versions of `aws-general` and `aws-kinesis` which support the
+  security token header (necessary for using credentials from EC2 instance
+  metadata). The --use-instance-metadata option should now work properly.
+
+- When --restore-state is passed with a non-existent file, it will be ignored;
+  if it is passed with a malformed file, an error will be thrown; the old
+  behavior was to throw an error in either case.
+
 ### v0.2.0.1
 
 All changes were in the Consumer CLI.
diff --git a/aws-kinesis-client.cabal b/aws-kinesis-client.cabal
--- a/aws-kinesis-client.cabal
+++ b/aws-kinesis-client.cabal
@@ -1,5 +1,5 @@
 name:                aws-kinesis-client
-version:             0.2.0.1
+version:             0.2.0.2
 synopsis:            A producer & consumer client library for AWS Kinesis
 -- description:
 license:             Apache-2.0
@@ -26,7 +26,7 @@
                        base-unicode-symbols,
                        aeson >=0.8,
                        aws >=0.10.5,
-                       aws-kinesis >=0.1.2,
+                       aws-kinesis >=0.1.3,
                        conduit >=1.2.3.1,
                        containers >=0.5.5.1,
                        data-carousel >=0.1.0.0,
diff --git a/cli/CLI.hs b/cli/CLI.hs
--- a/cli/CLI.hs
+++ b/cli/CLI.hs
@@ -58,19 +58,21 @@
 import Control.Monad.Trans.Reader (ReaderT(..))
 import Control.Monad.Error.Class
 import Control.Monad.Error.Hoist
+import Control.Monad.Unicode
 
 import qualified Data.Aeson as A
 import qualified Data.ByteString.Char8 as B8
 import qualified Data.ByteString.Lazy.Char8 as BL8
 import Data.Conduit
 import qualified Data.Conduit.List as CL
+import Data.Monoid.Unicode
 import Data.Traversable
 import Data.Typeable
 
 import Options.Applicative
 import qualified Network.HTTP.Conduit as HC
 import Prelude.Unicode
-import Control.Monad.Unicode
+import System.IO.Error
 
 data CLIError
   = MissingCredentials
@@ -114,11 +116,15 @@
   manager ← managedHttpManager
   credentials ← lift fetchCredentials
   savedStreamState ←
-    for _clioStateIn $
-      either (fail ∘ ("Invalid saved state: " ++))  return
-        <=< fmap A.eitherDecode
-          ∘ liftIO
-          ∘ BL8.readFile
+    case _clioStateIn of
+      Just path → liftIO $ do
+        code ← catch (Just <$> BL8.readFile path) $ \case
+          exn
+            | isDoesNotExistError exn → return Nothing
+            | otherwise → throw exn
+        traverse (either (fail ∘ ("Invalid saved state: " ⊕)) return) $
+          A.eitherDecode <$> code
+      Nothing → return Nothing
 
   consumer ← managedKinesisConsumer $ ConsumerKit
     { _ckKinesisKit = KinesisKit
diff --git a/src/Aws/Kinesis/Client/Producer.hs b/src/Aws/Kinesis/Client/Producer.hs
--- a/src/Aws/Kinesis/Client/Producer.hs
+++ b/src/Aws/Kinesis/Client/Producer.hs
@@ -72,7 +72,6 @@
 ) where
 
 import qualified Aws.Kinesis as Kin
-import qualified Aws.Kinesis.Commands.PutRecords as Kin
 import Aws.Kinesis.Client.Common
 
 import Control.Applicative