diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 5199016..c73efcf 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1791,6 +1791,21 @@ Resources:
                 Action:
                   - logs:DescribeLogGroups
                 Resource: "*"
+              # HTTP API stage access_log_settings uses Log Delivery APIs
+              # (account-level Resource "*"). PutResourcePolicy is intentionally
+              # omitted: MealOrderApiAccessLogResourcePolicy below pre-grants
+              # delivery.logs.amazonaws.com on the meal-order API log group so
+              # the apply role cannot mutate account-wide log resource policies.
+              - Sid: MealOrderApiGwAccessLogDelivery
+                Effect: Allow
+                Action:
+                  - logs:CreateLogDelivery
+                  - logs:GetLogDelivery
+                  - logs:UpdateLogDelivery
+                  - logs:DeleteLogDelivery
+                  - logs:ListLogDeliveries
+                  - logs:DescribeResourcePolicies
+                Resource: "*"
               - Sid: StackBuckets
                 Effect: Allow
                 Action:
@@ -1926,3 +1941,36 @@ Resources:
                   - ses:GetIdentityVerificationAttributes
                   - ses:GetSendQuota
                 Resource: "*"
+
+  # Pre-grant delivery.logs write to the meal-order API access log group so
+  # hcptf-meal-order-manager does not need logs:PutResourcePolicy (account-wide).
+  # Deployed by CDK CFN exec on substrate update (PLAT-99).
+  MealOrderApiAccessLogResourcePolicy:
+    Type: AWS::Logs::ResourcePolicy
+    Condition: IsProdAccount
+    Properties:
+      PolicyName: MealOrderManagerApiAccessLogDelivery
+      PolicyDocument: !Sub |
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "AWSLogDeliveryWrite",
+              "Effect": "Allow",
+              "Principal": { "Service": "delivery.logs.amazonaws.com" },
+              "Action": [
+                "logs:CreateLogStream",
+                "logs:PutLogEvents"
+              ],
+              "Resource": [
+                "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/meal-order-manager",
+                "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/meal-order-manager:*"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "aws:SourceAccount": "${AWS::AccountId}"
+                }
+              }
+            }
+          ]
+        }