diff --git a/cdk/assets/grafana_userdata.sh b/cdk/assets/grafana_userdata.sh
index bd7c5bd..f67ade6 100644
--- a/cdk/assets/grafana_userdata.sh
+++ b/cdk/assets/grafana_userdata.sh
@@ -25,7 +25,9 @@ REPO
 dnf install -y grafana
 
 # --- Athena datasource plugin (pinned for reproducibility) ---
-grafana-cli --pluginsDir /var/lib/grafana/plugins plugins install grafana-athena-datasource "${PLUGIN_VERSION}"
+# --homepath is required or grafana-cli can't find its config defaults.
+grafana-cli --homepath=/usr/share/grafana --pluginsDir=/var/lib/grafana/plugins \
+  plugins install grafana-athena-datasource "${PLUGIN_VERSION}"
 
 # --- grafana.ini: behind the ALB at grafana.seahaven.com, kiosk-friendly ---
 cat >/etc/grafana/grafana.ini <<'INI'
diff --git a/cdk/cdk.json b/cdk/cdk.json
index 5d9f993..bf1cadf 100644
--- a/cdk/cdk.json
+++ b/cdk/cdk.json
@@ -12,6 +12,6 @@
     "grafanaPrivateSubnetIds": ["subnet-04e38c507e96f1926", "subnet-0a0b4fc6f296dfba5"],
     "grafanaDomain": "grafana.seahaven.com",
     "officeCidrs": ["47.21.61.4/32", "96.250.164.146/32"],
-    "athenaPluginVersion": "2.18.2"
+    "athenaPluginVersion": "3.2.0"
   }
 }