diff --git a/remote/lib/llm-stack.ts b/remote/lib/llm-stack.ts
index 585e3d7a..9ed40d7f 100644
--- a/remote/lib/llm-stack.ts
+++ b/remote/lib/llm-stack.ts
@@ -531,9 +531,16 @@ export class LlmStack extends cdk.Stack {
       }),
     );
     seedLaunchStatements().forEach((s) => deployFn.addToRolePolicy(s));
+    // CreateSecret/DescribeSecret mint the environment's key on first deploy;
+    // PutSecretValue rotates it when a deploy supplies a key, which
+    // invalidates the old value. All scoped to the per-environment secrets.
     deployFn.addToRolePolicy(
       new iam.PolicyStatement({
-        actions: ['secretsmanager:CreateSecret', 'secretsmanager:DescribeSecret'],
+        actions: [
+          'secretsmanager:CreateSecret',
+          'secretsmanager:DescribeSecret',
+          'secretsmanager:PutSecretValue',
+        ],
         resources: [envSecretArn],
       }),
     );
diff --git a/remote/test/stack.test.ts b/remote/test/stack.test.ts
index 1c312c73..81e39a9c 100644
--- a/remote/test/stack.test.ts
+++ b/remote/test/stack.test.ts
@@ -172,6 +172,7 @@ describe('LlmStack (control plane)', () => {
       'ec2:AuthorizeSecurityGroupIngress',
       'ec2:RevokeSecurityGroupIngress',
       'secretsmanager:CreateSecret',
+      'secretsmanager:PutSecretValue',
     ]) {
       expect(actions).toContain(action);
     }