diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js
index ef82639..d0a23ef 100644
--- a/dist/cleanup/index.js
+++ b/dist/cleanup/index.js
@@ -17699,7 +17699,7 @@ async function retryAndBackoff(fn, isRetryable, maxRetries = 12, retries = 0, ba
         // It's retryable, so sleep and retry.
         await sleep(Math.random() * (Math.pow(2, retries) * base));
         retries += 1;
-        if (retries === maxRetries) {
+        if (retries >= maxRetries) {
             throw err;
         }
         return await retryAndBackoff(fn, isRetryable, maxRetries, retries, base);
diff --git a/dist/index.js b/dist/index.js
index e141926..b0a47d6 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -363,7 +363,7 @@ async function retryAndBackoff(fn, isRetryable, maxRetries = 12, retries = 0, ba
         // It's retryable, so sleep and retry.
         await sleep(Math.random() * (Math.pow(2, retries) * base));
         retries += 1;
-        if (retries === maxRetries) {
+        if (retries >= maxRetries) {
             throw err;
         }
         return await retryAndBackoff(fn, isRetryable, maxRetries, retries, base);
@@ -451,7 +451,10 @@ async function run() {
         const unsetCurrentCredentials = unsetCurrentCredentialsInput.toLowerCase() === 'true';
         const disableRetryInput = core.getInput('disable-retry', { required: false }) || 'false';
         const disableRetry = disableRetryInput.toLowerCase() === 'true';
-        const maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
+        let maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
+        if (maxRetries < 1) {
+            maxRetries = 1;
+        }
         for (const managedSessionPolicy of managedSessionPoliciesInput) {
             managedSessionPolicies.push({ arn: managedSessionPolicy });
         }
diff --git a/src/helpers.ts b/src/helpers.ts
index 3b84d16..988ef39 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -124,7 +124,7 @@ export async function retryAndBackoff<T>(
     // It's retryable, so sleep and retry.
     await sleep(Math.random() * (Math.pow(2, retries) * base));
     retries += 1;
-    if (retries === maxRetries) {
+    if (retries >= maxRetries) {
       throw err;
     }
     return await retryAndBackoff(fn, isRetryable, maxRetries, retries, base);
diff --git a/src/index.ts b/src/index.ts
index e4ecf48..6c80d3c 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -44,7 +44,10 @@ export async function run() {
     const unsetCurrentCredentials = unsetCurrentCredentialsInput.toLowerCase() === 'true';
     const disableRetryInput = core.getInput('disable-retry', { required: false }) || 'false';
     const disableRetry = disableRetryInput.toLowerCase() === 'true';
-    const maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
+    let maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
+    if (maxRetries < 1) {
+      maxRetries = 1;
+    }
     for (const managedSessionPolicy of managedSessionPoliciesInput) {
       managedSessionPolicies.push({ arn: managedSessionPolicy });
     }
diff --git a/test/index.test.ts b/test/index.test.ts
index 0b6cf4d..4b83bce 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -632,6 +632,25 @@ describe('Configure AWS Credentials', () => {
     expect(core.setFailed).toHaveBeenCalledWith('Could not assume role with OIDC: ');
   });
 
+  test('max retries negative input does not retry', async () => {
+    process.env['GITHUB_ACTIONS'] = 'true';
+    process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] = 'test-token';
+    jest.spyOn(core, 'getInput').mockImplementation(
+      mockGetInput({
+        'role-to-assume': ROLE_ARN,
+        'aws-region': FAKE_REGION,
+        'retry-max-attempts': '-1',
+      })
+    );
+    mockedSTS.reset();
+    mockedSTS.on(AssumeRoleWithWebIdentityCommand).rejects();
+
+    await run();
+
+    expect(mockedSTS.commandCalls(AssumeRoleWithWebIdentityCommand).length).toEqual(1);
+    expect(core.setFailed).toHaveBeenCalledWith('Could not assume role with OIDC: ');
+  });
+
   test('role external ID provided', async () => {
     jest
       .spyOn(core, 'getInput')