diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 2c11a7d..5199016 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1881,6 +1881,18 @@ Resources:
                 Action:
                   - ssm:DescribeParameters
                 Resource: "*"
+              # API Gateway Lambda authorizer requires PassRole to
+              # apigateway.amazonaws.com. Shared HcptfIamManagementPolicy only
+              # grants PassRole to lambda.amazonaws.com (see IAMPassRole comment).
+              - Sid: MealOrderPassRoleApiGateway
+                Effect: Allow
+                Action:
+                  - iam:PassRole
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/meal-order-manager-*"
+                Condition:
+                  StringEquals:
+                    "iam:PassedToService": "apigateway.amazonaws.com"
               - Sid: ReadWafWebAcl
                 Effect: Allow
                 Action: