diff --git a/terraform/data.tf b/terraform/data.tf
index 0df5022..89c3c5b 100644
--- a/terraform/data.tf
+++ b/terraform/data.tf
@@ -1,7 +1,3 @@
-data "aws_ssm_parameter" "dynamodb_cmk" {
-  name = local.dynamodb_cmk_ssm
-}
-
 resource "aws_dynamodb_table" "dashboard" {
   name         = local.table_name
   billing_mode = "PAY_PER_REQUEST"
@@ -19,7 +15,7 @@ resource "aws_dynamodb_table" "dashboard" {
 
   server_side_encryption {
     enabled     = true
-    kms_key_arn = data.aws_ssm_parameter.dynamodb_cmk.value
+    kms_key_arn = local.dynamodb_cmk_arn
   }
 }
 
diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 97f7088..f0340e8 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -472,7 +472,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "kms:ListGrants",
       "kms:RetireGrant",
     ]
-    resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
+    resources = [local.dynamodb_cmk_arn]
   }
 
   statement {
@@ -820,7 +820,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "kms:GetKeyPolicy",
       "kms:ListResourceTags",
     ]
-    resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
+    resources = [local.dynamodb_cmk_arn]
   }
 
   statement {
diff --git a/terraform/lambda.tf b/terraform/lambda.tf
index b6db98a..610862b 100644
--- a/terraform/lambda.tf
+++ b/terraform/lambda.tf
@@ -18,7 +18,7 @@ data "aws_iam_policy_document" "lambda_assume" {
 
 locals {
   table_arn = aws_dynamodb_table.dashboard.arn
-  cmk_arn   = data.aws_ssm_parameter.dynamodb_cmk.value
+  cmk_arn   = local.dynamodb_cmk_arn
 
   lambda_identity = {
     process_csv = [
diff --git a/terraform/lambda_boundary.tf b/terraform/lambda_boundary.tf
index 90d1589..0fed759 100644
--- a/terraform/lambda_boundary.tf
+++ b/terraform/lambda_boundary.tf
@@ -87,7 +87,7 @@ data "aws_iam_policy_document" "lambda_boundary" {
       "kms:GenerateDataKey",
       "kms:DescribeKey",
     ]
-    resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
+    resources = [local.dynamodb_cmk_arn]
 
     condition {
       test     = "StringEquals"
diff --git a/terraform/locals.tf b/terraform/locals.tf
index ab14795..cd61802 100644
--- a/terraform/locals.tf
+++ b/terraform/locals.tf
@@ -23,14 +23,18 @@ locals {
   # Org has Actions OIDC use_immutable_subject=true.
   github_oidc_sub = "repo:Sea-Haven-Industries@183236204/payments-dashboard@1206210946:environment:prod"
 
-  secret_names = [
-    "payments-dashboard/slack-bot-token",
-    "payments-dashboard/slack-signing-secret",
-    "payments-dashboard/boa-check-mgmt",
-    "payments-dashboard/boa-reporting",
-    "payments-dashboard/expense-slack-token",
-    "payments-dashboard/expense-slack-signing-secret",
-  ]
+  dynamodb_cmk_arn = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
+
+  # Exact ARNs (ticket rule). Hardcoded so the first plan can run as
+  # hcptf-bootstrap-plan, which cannot ssm:GetParameter / DescribeSecret.
+  secret_arns = {
+    "payments-dashboard/slack-bot-token"              = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
+    "payments-dashboard/slack-signing-secret"         = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
+    "payments-dashboard/boa-check-mgmt"               = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
+    "payments-dashboard/boa-reporting"                = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
+    "payments-dashboard/expense-slack-token"          = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
+    "payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
+  }
 
   functions = {
     process_csv = {
diff --git a/terraform/secrets.tf b/terraform/secrets.tf
index eaeddbf..b1572b6 100644
--- a/terraform/secrets.tf
+++ b/terraform/secrets.tf
@@ -1,8 +1,2 @@
-data "aws_secretsmanager_secret" "this" {
-  for_each = toset(local.secret_names)
-  name     = each.value
-}
-
-locals {
-  secret_arns = { for name, secret in data.aws_secretsmanager_secret.this : name => secret.arn }
-}
+# Secret values stay in Secrets Manager. ARNs are pinned in locals.tf so the
+# first bootstrap-plan does not need secretsmanager:DescribeSecret.