diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index eea7da1..dbe482d 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1448,6 +1448,12 @@ Resources:
                   - iam:ListRoleTags
                 Resource:
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/githubdeploy-seahaven-site"
+              - Sid: RefreshGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: RefreshManagedPolicies
                 Effect: Allow
                 Action:
@@ -1507,6 +1513,12 @@ Resources:
                 Resource:
                   - arn:aws:s3:::seahaven-site-prod
                   - arn:aws:s3:::seahaven-site-prod/*
+              - Sid: ReadGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: CloudFrontManage
                 Effect: Allow
                 Action: