diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 11c4ac4..31fe9b9 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1180,6 +1180,10 @@ Resources:
                 Action:
                   - lambda:GetEventSourceMapping
                   - lambda:ListTags
+                  # Tag/Untag on ESM UUID ARNs do not carry FunctionArn in the
+                  # request context (provider default_tags on import).
+                  - lambda:TagResource
+                  - lambda:UntagResource
                 Resource: "*"
               - Sid: LambdaEventSourceMappings
                 Effect: Allow
@@ -1187,8 +1191,6 @@ Resources:
                   - lambda:CreateEventSourceMapping
                   - lambda:DeleteEventSourceMapping
                   - lambda:UpdateEventSourceMapping
-                  - lambda:TagResource
-                  - lambda:UntagResource
                 Resource: "*"
                 Condition:
                   "ForAnyValue:StringLike":
@@ -1308,6 +1310,8 @@ Resources:
                   - !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*"
                   - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com
                   - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/*
+                  # TagResource/UntagResource authorize against /tags/<arn>.
+                  - arn:aws:apigateway:us-east-1::/tags/*
               - Sid: SesReceiptRules
                 Effect: Allow
                 Action: