diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 2beb176..0fa6684 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1698,6 +1698,13 @@ Resources:
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/waf/app-web-acl-arn"
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"
+              # aws_ssm_parameter refresh uses DescribeParameters (collection API;
+              # resource-level parameter ARNs are a silent no-op for this action).
+              - Sid: RefreshSsmDescribeParameters
+                Effect: Allow
+                Action:
+                  - ssm:DescribeParameters
+                Resource: "*"
               - Sid: RefreshWafWebAcl
                 Effect: Allow
                 Action:
@@ -1866,6 +1873,12 @@ Resources:
                   - ssm:ListTagsForResource
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"
+              # Collection API required for aws_ssm_parameter refresh/import.
+              - Sid: MealOrderSsmDescribeParameters
+                Effect: Allow
+                Action:
+                  - ssm:DescribeParameters
+                Resource: "*"
               - Sid: ReadWafWebAcl
                 Effect: Allow
                 Action: