diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml
index 7524228..a0dd735 100644
--- a/policies/kv/service/terraform/infra.yaml
+++ b/policies/kv/service/terraform/infra.yaml
@@ -5,6 +5,11 @@ rules:
   - path: "kv/data/service/terraform/infra"
     capabilities:
       - read
+  # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
+  # metadata path on every plan/apply; a 403 here fails the plan.
+  - path: "kv/metadata/service/terraform/infra"
+    capabilities:
+      - read
 
 auth:
   approle: