diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index e891e94..a5fc6eb 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -721,9 +721,9 @@ resource "aws_iam_role" "hcptf_apply" {
   }
 
   # Apply role cannot iam:TagRole on itself. Provider default_tags
-  # (Environment/Workspace) would otherwise 403 mid-apply.
+  # merge into tags_all, so ignoring tags alone still 403s mid-apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }
 
@@ -746,7 +746,7 @@ resource "aws_iam_role" "hcptf_plan" {
 
   # Same self-tag restriction as hcptf_apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }