diff --git a/bootstrap.yaml b/bootstrap.yaml
index 88cc0f5..ce05c19 100644
--- a/bootstrap.yaml
+++ b/bootstrap.yaml
@@ -121,6 +121,13 @@ Resources:
                   - "iam:ListAttachedUserPolicies"
                   - "iam:ListGroupsForUser"
                 Resource: !Sub "arn:aws:iam::${AWS::AccountId}:user/sh-openswe-traces-*"
+              # Required because template.yaml uses Transform: AWS::Serverless-2016-10-31.
+              # CloudFormation (as this exec role) must CreateChangeSet on the AWS-managed
+              # SAM transform macro. Scoped to only that transform ARN.
+              - Sid: SamTransform
+                Effect: Allow
+                Action: "cloudformation:CreateChangeSet"
+                Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31"
 
   DeployRole:
     Type: AWS::IAM::Role