diff --git a/.github/workflows/cd-infra.yml b/.github/workflows/cd-infra.yml
index 61c29001..510bbe18 100644
--- a/.github/workflows/cd-infra.yml
+++ b/.github/workflows/cd-infra.yml
@@ -81,11 +81,13 @@ jobs:
           aws-region: us-east-1
       - name: CDK deploy (dev only)
         working-directory: infra
-        run: npx cdk deploy OpenSweDevStack --require-approval never
+        # --outputs-file lets us print the stack outputs from CDK's own result
+        # (the deploy role intentionally lacks cloudformation:DescribeStacks; CDK
+        # gets outputs via the bootstrap cfn-exec role it assumes, so no extra grant).
+        run: npx cdk deploy OpenSweDevStack --require-approval never --outputs-file cdk-outputs.json
       - name: Stack outputs
-        run: |
-          aws cloudformation describe-stacks --stack-name open-swe-dev \
-            --query 'Stacks[0].Outputs[*].[OutputKey,OutputValue]' --output table
+        working-directory: infra
+        run: cat cdk-outputs.json
 
   deploy-prod:
     name: Deploy open-swe-prod
@@ -115,8 +117,8 @@ jobs:
           aws-region: us-east-1
       - name: CDK deploy (prod only)
         working-directory: infra
-        run: npx cdk deploy OpenSweProdStack --require-approval never
+        # See deploy-dev: --outputs-file avoids needing cloudformation:DescribeStacks.
+        run: npx cdk deploy OpenSweProdStack --require-approval never --outputs-file cdk-outputs.json
       - name: Stack outputs
-        run: |
-          aws cloudformation describe-stacks --stack-name open-swe-prod \
-            --query 'Stacks[0].Outputs[*].[OutputKey,OutputValue]' --output table
+        working-directory: infra
+        run: cat cdk-outputs.json
diff --git a/.gitignore b/.gitignore
index f3850d6f..5ea41695 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,4 +71,4 @@ __pycache__/
 # Local working docs (gitignored — survives upstream merges, never pushed)
 TODO.md
 
-# 
\ No newline at end of file
+# infra/cdk-outputs.json