diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index b8f1973..fbb3279 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -76,6 +76,18 @@ Resources:
                   - cloudfront:*
                   - ssm:*
                 Resource: "*"
+              # WAF (audit M-17) — needed for SAM/CFN-managed WebACL associations
+              # on CloudFront distributions (meal-order-manager orders). Read +
+              # (dis)associate only, not wafv2:*. Added 2026-06-02.
+              - Effect: Allow
+                Action:
+                  - wafv2:GetWebACL
+                  - wafv2:GetWebACLForResource
+                  - wafv2:ListWebACLs
+                  - wafv2:AssociateWebACL
+                  - wafv2:DisassociateWebACL
+                  - wafv2:ListResourcesForWebACL
+                Resource: "*"
 
   # ---------------------------------------------------------------------------
   # SAM deploy roles (4 repos)