diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index b05d16c..1d11f47 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -228,6 +228,11 @@ CloudFormation update, which required `cloudformation:UpdateStack`. That
 mutation is limited to the single existing Elastic Beanstalk-managed stack ARN
 for `shoc-backend-dev`; it cannot create stacks or update any other stack.
 
+Once `UpdateStack` was allowed, CloudFormation returned `S3 error: Access
+Denied` while resolving the Elastic Beanstalk-managed template. The caller
+therefore receives `s3:GetObject` on the same Beanstalk-only object namespace;
+the policy still does not grant `s3:Get*` or access to other bucket names.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index fab7154..99d64fa 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -211,7 +211,7 @@ export class DeployDevStack extends cdk.Stack {
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
-        actions: ['s3:DeleteObject', 's3:GetObjectAcl'],
+        actions: ['s3:DeleteObject', 's3:GetObject', 's3:GetObjectAcl'],
         // UpdateEnvironment also checks and removes temporary objects in
         // AWS-owned Elastic Beanstalk buckets. AWS Support case
         // 178526484500047 confirmed that the caller's identity policy must