diff --git a/template.yaml b/template.yaml
index 68f325a..639c65e 100644
--- a/template.yaml
+++ b/template.yaml
@@ -156,16 +156,19 @@ Resources:
         - DynamoDBCrudPolicy:
             TableName: !Ref ShiftTable
         - Statement:
+            # Least privilege: only the Slack bot token, not the whole namespace.
             - Effect: Allow
               Action:
                 - secretsmanager:GetSecretValue
               Resource:
-                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/*"
+                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/slack-bot-token-*"
             - Effect: Allow
               Action:
                 - ses:SendEmail
               Resource:
-                - !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/*"
+                # Only the single sending identity (noreply@seahaven.com), not
+                # every identity in the account.
+                - !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/noreply@seahaven.com"
                 # The sending identity has a default configuration set
                 # (seahaven-email-events); SES authorizes SendEmail against the
                 # config-set resource too, so it must be granted alongside the
@@ -207,11 +210,12 @@ Resources:
         - DynamoDBCrudPolicy:
             TableName: !Ref ShiftTable
         - Statement:
+            # Least privilege: only the 3cx-* secrets this function reads.
             - Effect: Allow
               Action:
                 - secretsmanager:GetSecretValue
               Resource:
-                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/*"
+                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
       Events:
         # Daily at 6am ET (before the 7am schedule post and 8am 3CX scheduler)
         # EST: 6am ET = 11:00 UTC (Nov-Mar)
@@ -249,11 +253,12 @@ Resources:
         - DynamoDBCrudPolicy:
             TableName: !Ref ShiftTable
         - Statement:
+            # Least privilege: only the 3cx-* secrets this function reads.
             - Effect: Allow
               Action:
                 - secretsmanager:GetSecretValue
               Resource:
-                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/*"
+                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
       Events:
         # Daily at 8am ET — update after-hours routing
         DailyScheduleEST: