diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index bdbb6de..acbbf81 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -841,12 +841,34 @@ Resources:
                   - !Sub "arn:aws:s3:::sh-openswe-traces-${AWS::AccountId}/*"
                   - !Sub "arn:aws:s3:::sh-openswe-traces-logs-${AWS::AccountId}"
                   - !Sub "arn:aws:s3:::sh-openswe-traces-logs-${AWS::AccountId}/*"
-              # CreateKey / ListAliases are account-level; key ARN is unknown
-              # until create. Alias + key policy ops scoped after create via *.
-              - Sid: TracesKms
+              # CreateKey is account-level; pin via RequestTag matching the
+              # app provider default_tags (Project=sh-openswe-traces). Key
+              # admin after create requires the same ResourceTag — no
+              # unconstrained PutKeyPolicy/DisableKey on unrelated CMKs.
+              - Sid: TracesKmsCreate
                 Effect: Allow
                 Action:
                   - kms:CreateKey
+                Resource: "*"
+                Condition:
+                  StringEquals:
+                    "aws:RequestTag/Project": sh-openswe-traces
+              - Sid: TracesKmsList
+                Effect: Allow
+                Action:
+                  - kms:ListAliases
+                Resource: "*"
+              - Sid: TracesKmsAlias
+                Effect: Allow
+                Action:
+                  - kms:CreateAlias
+                  - kms:UpdateAlias
+                  - kms:DeleteAlias
+                Resource:
+                  - !Sub "arn:aws:kms:us-east-1:${AWS::AccountId}:alias/sh-openswe-traces"
+              - Sid: TracesKmsKey
+                Effect: Allow
+                Action:
                   - kms:TagResource
                   - kms:UntagResource
                   - kms:ScheduleKeyDeletion
@@ -858,13 +880,16 @@ Resources:
                   - kms:GetKeyPolicy
                   - kms:GetKeyRotationStatus
                   - kms:ListResourceTags
+                  - kms:EnableKey
+                  - kms:DisableKey
+                  # Alias attach/detach also authorizes against the key ARN.
                   - kms:CreateAlias
                   - kms:UpdateAlias
                   - kms:DeleteAlias
-                  - kms:ListAliases
-                  - kms:EnableKey
-                  - kms:DisableKey
                 Resource: "*"
+                Condition:
+                  StringEquals:
+                    "aws:ResourceTag/Project": sh-openswe-traces
               - Sid: ExportIamUser
                 Effect: Allow
                 Action: