diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index 17d5818..70c1e7d 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -417,6 +417,10 @@ Resources:
                   - s3:PutLifecycleConfiguration
                   - s3:GetBucketPublicAccessBlock
                   - s3:PutBucketPublicAccessBlock
+                  # Explicit BucketEncryption blocks (first: payments-dashboard
+                  # BoaRawBucket, 2026-07-22) need the encryption config pair.
+                  - s3:GetEncryptionConfiguration
+                  - s3:PutEncryptionConfiguration
                   - s3:GetBucketNotification
                   - s3:PutBucketNotification
                   - s3:GetBucketWebsite