diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index db1988b..d469b61 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -304,6 +304,12 @@ function servicesPolicy(): object {
         ],
         Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/${prefix}/*`,
       },
+      {
+        Sid: "EksAmiRead",
+        Effect: "Allow",
+        Action: ["ssm:GetParameter", "ssm:GetParameters"],
+        Resource: "arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
+      },
       {
         Sid: "SsmList",
         Effect: "Allow",
@@ -533,7 +539,10 @@ function planPolicy(hcpArn: string, githubArn: string): object {
         Sid: "SsmReads",
         Effect: "Allow",
         Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:ListTagsForResource"],
-        Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
+        Resource: [
+          `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
+          "arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
+        ],
       },
     ],
   };