diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml
index 0b787f0..4bd811d 100644
--- a/lib/deploy-substrate/deploy-substrate.template.yaml
+++ b/lib/deploy-substrate/deploy-substrate.template.yaml
@@ -876,8 +876,10 @@ Resources:
               - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/webhook-api-key-44b0jB
               - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/google-service-account-PcUeJD
               - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/slack-bot-token-L8DntD
+              - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/slack-admin-token-LHr2VD
               - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/front-inboxes-write-v6niDC
               - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/3cx-system-admin-PcUeJD
+              - arn:aws:secretsmanager:us-east-1:011934824531:secret:paychex-integrations/afterhours-roster-token-j3yCh7
           - Sid: PaychexIntegrationsDynamoDB
             Effect: Allow
             Action:
@@ -887,8 +889,38 @@ Resources:
               - dynamodb:DeleteItem
               - dynamodb:ConditionCheckItem
               - dynamodb:DescribeTable
+              - dynamodb:Query
             Resource:
               - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-worker-ledger"
+              - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-worker-ledger/index/*"
+              - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-webhook-notifications"
+              - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-payroll-notices"
+              - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-checkcomponents-posted"
+              - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/paychex-checkcomponents-period"
+          - Sid: PaychexIntegrationsSqsConsume
+            Effect: Allow
+            Action:
+              - sqs:ReceiveMessage
+              - sqs:DeleteMessage
+              - sqs:GetQueueAttributes
+              - sqs:ChangeMessageVisibility
+            Resource:
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-webhook-events"
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-login-delay"
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-checkcomponents"
+          - Sid: PaychexIntegrationsSqsSend
+            Effect: Allow
+            Action:
+              - sqs:SendMessage
+            Resource:
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-webhook-events"
+              - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:paychex-login-delay"
+          - Sid: PaychexIntegrationsSns
+            Effect: Allow
+            Action:
+              - sns:Publish
+            Resource:
+              - !Sub "arn:aws:sns:us-east-1:${AWS::AccountId}:site-alerts"
 
   ProcurementIngestBoundary:
     Type: AWS::IAM::ManagedPolicy