diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 4c3a6f5..db1988b 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -491,6 +491,18 @@ function planPolicy(hcpArn: string, githubArn: string): object {
         Action: ["kms:ListAliases", "ssm:DescribeParameters"],
         Resource: "*",
       },
+      {
+        Sid: "EcrPublicAuth",
+        Effect: "Allow",
+        Action: "ecr-public:GetAuthorizationToken",
+        Resource: "*",
+      },
+      {
+        Sid: "StsForPublicEcr",
+        Effect: "Allow",
+        Action: "sts:GetServiceBearerToken",
+        Resource: "*",
+      },
       {
         Sid: "EcrReads",
         Effect: "Allow",