diff --git a/infra/aws/main/iam.tf b/infra/aws/main/iam.tf
index 417526e..6147192 100644
--- a/infra/aws/main/iam.tf
+++ b/infra/aws/main/iam.tf
@@ -39,6 +39,7 @@ data "aws_iam_policy_document" "github_actions_infrastructure" {
       "iam:CreateOpenIDConnectProvider",
       "iam:GetOpenIDConnectProvider",
       "iam:UpdateOpenIDConnectProvider",
+      "iam:UpdateOpenIDConnectProviderThumbprint",
       "iam:DeleteOpenIDConnectProvider",
       "iam:ListOpenIDConnectProviders",
       "iam:TagOpenIDConnectProvider",