diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 200def8..bdbb6de 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -891,12 +891,14 @@ Resources:
                   - iam:ListUsers
                   - iam:GetAccountSummary
                 Resource: "*"
-              # Shell lifecycle only — no GetSecretValue / PutSecretValue so
-              # apply never renders key material into HCP state or run logs.
+              # Shell lifecycle only — no GetSecretValue / PutSecretValue /
+              # UpdateSecret so apply never renders or overwrites key material
+              # in HCP state or run logs. CreateSecret is only on
+              # ExportSecretCreate with an exact Name pin (not this ARN
+              # prefix, which would also match longer secret names).
               - Sid: ExportSecretShell
                 Effect: Allow
                 Action:
-                  - secretsmanager:CreateSecret
                   - secretsmanager:DeleteSecret
                   - secretsmanager:DescribeSecret
                   - secretsmanager:GetResourcePolicy
@@ -904,7 +906,6 @@ Resources:
                   - secretsmanager:DeleteResourcePolicy
                   - secretsmanager:TagResource
                   - secretsmanager:UntagResource
-                  - secretsmanager:UpdateSecret
                 Resource:
                   - !Sub "arn:aws:secretsmanager:us-east-1:${AWS::AccountId}:secret:sh-openswe/langsmith-export-s3-*"
               - Sid: ExportSecretCreate