diff --git a/.gitignore b/.gitignore
index 77fb9d3..8f219ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@ __pycache__/
 .aws-sam/
 .env
 packaged.yaml
+output.json
+.DS_Store
diff --git a/src/handler.py b/src/handler.py
index d99f781..053a163 100644
--- a/src/handler.py
+++ b/src/handler.py
@@ -6,7 +6,7 @@ from datetime import datetime, timezone, timedelta
 import boto3
 import yaml
 
-from three_cx_client import ThreeCXClient
+from src.three_cx_client import ThreeCXClient
 
 logger = logging.getLogger()
 logger.setLevel(logging.INFO)
@@ -67,12 +67,13 @@ def handler(event, context):
     current_hour = now.hour
     logger.info("Running 3CX ring group scheduler at %s", now.isoformat())
 
-    if current_hour != 8:
+    force = event.get("force", False)
+    if not force and current_hour != 8:
         logger.info("Current ET hour is %d, not 8am — skipping (wrong DST rule fired)", current_hour)
         return {"skipped": True, "reason": f"ET hour is {current_hour}, not 8"}
 
     schedule = load_schedule()
-    extension = resolve_extension(schedule, now)
+    extension = event.get("override_extension") or resolve_extension(schedule, now)
 
     creds = get_3cx_credentials()
     client = ThreeCXClient(
diff --git a/template.yaml b/template.yaml
index 74faa9a..ec1829a 100644
--- a/template.yaml
+++ b/template.yaml
@@ -25,8 +25,22 @@ Resources:
           SSM_PREFIX: /3cx-scheduler
           TZ: !Ref Timezone
       Policies:
-        - SSMParameterWithSlashPrefixReadPolicy:
-            ParameterName: 3cx-scheduler
+        - Statement:
+            - Effect: Allow
+              Action:
+                - ssm:GetParametersByPath
+                - ssm:GetParameter
+                - ssm:GetParameters
+              Resource:
+                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler"
+                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler/*"
+            - Effect: Allow
+              Action:
+                - kms:Decrypt
+              Resource: "*"
+              Condition:
+                StringEquals:
+                  "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
       Events:
         # EST: 8am ET = 13:00 UTC (Nov-Mar)
         DailyScheduleEST: