diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index b629225..ecc1cbb 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -57,7 +57,6 @@ jobs:
 
       - name: Install Python dependencies
         if: ${{ inputs.python-version != '' }}
-        working-directory: ${{ inputs.cdk-dir }}
         run: |
           for req in $(find . -name requirements.txt -not -path '*/node_modules/*'); do
             pip install -r "$req"
diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index d4be4f0..1064656 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -54,6 +54,16 @@ Resources:
         - arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess
         - arn:aws:iam::aws:policy/AmazonSESFullAccess
         - arn:aws:iam::aws:policy/IAMFullAccess
+      Policies:
+        - PolicyName: cloudformation-transforms
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - cloudformation:CreateChangeSet
+                Resource:
+                  - arn:aws:cloudformation:us-east-1:aws:transform/*
 
   # ---------------------------------------------------------------------------
   # SAM deploy roles (5 repos)