diff --git a/template.yaml b/template.yaml
index 639c65e..e2532d4 100644
--- a/template.yaml
+++ b/template.yaml
@@ -250,7 +250,7 @@ Resources:
           QUEUE_NUMBER: !Ref QueueNumber
           TZ: !Ref Timezone
       Policies:
-        - DynamoDBCrudPolicy:
+        - DynamoDBReadPolicy:
             TableName: !Ref ShiftTable
         - Statement:
             # Least privilege: only the 3cx-* secrets this function reads.
@@ -333,11 +333,12 @@ Resources:
         - DynamoDBCrudPolicy:
             TableName: !Ref ShiftTable
         - Statement:
+            # Least privilege: only the 3cx-* secrets this function reads.
             - Effect: Allow
               Action:
                 - secretsmanager:GetSecretValue
               Resource:
-                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/*"
+                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
 
   # Lambda error alarm for the holiday router. Mirrors the account-wide
   # operational convention (Lambda-Errors-<fn>, threshold 1 over one 5-min