diff --git a/infrastructure/aws/README.md b/infrastructure/aws/README.md
index 844bc58f..6f23dbab 100644
--- a/infrastructure/aws/README.md
+++ b/infrastructure/aws/README.md
@@ -65,9 +65,11 @@
 | [aws_iam_role_policy.ci_plan_state_lock](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.ci_preview](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.lambda_cognito_admin](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.lambda_dsql_connect](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.lambda_s3_objects](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.lambda_ses_send](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy_attachment.ci_apply_admin](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.ci_plan_dsql_readonly](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.ci_plan_readonly](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.lambda_basic](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_lambda_function.functions](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/lambda_function) | resource |
diff --git a/infrastructure/aws/lambda.tf b/infrastructure/aws/lambda.tf
index 0f350199..959534d5 100644
--- a/infrastructure/aws/lambda.tf
+++ b/infrastructure/aws/lambda.tf
@@ -109,6 +109,22 @@ resource "aws_iam_role_policy" "lambda_ses_send" {
   })
 }
 
+# Resource "*" until the DSQL cluster exists; scope to its ARN then.
+resource "aws_iam_role_policy" "lambda_dsql_connect" {
+  name = "branch-lambda-dsql-connect"
+  role = aws_iam_role.lambda_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid      = "LambdaDsqlConnect"
+      Effect   = "Allow"
+      Action   = ["dsql:DbConnectAdmin"]
+      Resource = "*"
+    }]
+  })
+}
+
 # Get AWS account ID for unique bucket naming
 data "aws_caller_identity" "current" {}
 
diff --git a/infrastructure/aws/oidc.tf b/infrastructure/aws/oidc.tf
index a164cf57..3820a3f4 100644
--- a/infrastructure/aws/oidc.tf
+++ b/infrastructure/aws/oidc.tf
@@ -45,6 +45,12 @@ resource "aws_iam_role_policy_attachment" "ci_plan_readonly" {
   policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }
 
+# Plan needs dsql read access; ReadOnlyAccess is not guaranteed to include it.
+resource "aws_iam_role_policy_attachment" "ci_plan_dsql_readonly" {
+  role       = aws_iam_role.ci_plan.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonAuroraDSQLReadOnlyAccess"
+}
+
 resource "aws_iam_role_policy" "ci_plan_state_lock" {
   name = "tfstate-lock"
   role = aws_iam_role.ci_plan.id