diff --git a/servers/gcp/artifact-registry.tf b/servers/gcp/artifact-registry.tf
index 2791ccd..e7e5833 100644
--- a/servers/gcp/artifact-registry.tf
+++ b/servers/gcp/artifact-registry.tf
@@ -87,6 +87,16 @@ resource "google_artifact_registry_repository_iam_member" "ci_api" {
   member     = "serviceAccount:${google_service_account.ci_pusher.email}"
 }
 
+# ── CI pusher Cloud Run deploy permissions ────────────────────────────────────
+# The CI SA needs run.developer to deploy new revisions to Cloud Run.
+# run.developer grants: services.get, services.update, revisions.list, etc.
+
+resource "google_project_iam_member" "ci_pusher_run_developer" {
+  project = var.project_id
+  role    = "roles/run.developer"
+  member  = "serviceAccount:${google_service_account.ci_pusher.email}"
+}
+
 # ── CI pusher JSON key (download once, store in Vault/Secret Manager) ─────────
 # After `terraform apply`, create a key and save it to GCP Secret Manager:
 #   gcloud iam service-accounts keys create /tmp/ci-pusher.json \