diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 365b127..040d56b 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -110,7 +110,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       variable = "iam:PermissionsBoundary"
       values = [
         "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
-        "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary",
         "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
       ]
     }
@@ -131,7 +130,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       variable = "iam:PermissionsBoundary"
       values = [
         "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
-        "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary",
         "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
       ]
     }
@@ -328,9 +326,10 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
   }
 
   statement {
-    sid     = "RefreshLambda"
-    effect  = "Allow"
-    actions = ["lambda:*"]
+    sid    = "RefreshLambda"
+    effect = "Allow"
+    # Read-only refresh for plan. Mutate APIs stay on the apply role.
+    actions = ["lambda:Get*", "lambda:List*"]
     resources = [
       "arn:aws:lambda:us-east-1:${local.account_id}:function:afi-*",
       "arn:aws:lambda:us-east-1:${local.account_id}:layer:afi-shared*",