diff --git a/template.yaml b/template.yaml
index 5496e93..c351ba8 100644
--- a/template.yaml
+++ b/template.yaml
@@ -162,6 +162,11 @@ Resources:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: !Sub seahaven-payments-csv-${AWS::AccountId}
+      PublicAccessBlockConfiguration:
+        BlockPublicAcls: true
+        IgnorePublicAcls: true
+        BlockPublicPolicy: true
+        RestrictPublicBuckets: true
 
   DashboardTable:
     Type: AWS::DynamoDB::Table
@@ -190,6 +195,11 @@ Resources:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: !Sub seahaven-payroll-emails-${AWS::AccountId}
+      PublicAccessBlockConfiguration:
+        BlockPublicAcls: true
+        IgnorePublicAcls: true
+        BlockPublicPolicy: true
+        RestrictPublicBuckets: true
       LifecycleConfiguration:
         Rules:
           - Id: ExpireEmails