diff --git a/aws-bedrock.tf b/aws-bedrock.tf
index 3887250..58fc06a 100644
--- a/aws-bedrock.tf
+++ b/aws-bedrock.tf
@@ -163,6 +163,23 @@ resource "aws_iam_user_policy" "bedrock_opencode" {
         Action   = ["bedrock:ListModelInvocationJobs"]
         Resource = "*"
       },
+      {
+        # Model access page is retired: first invoke auto-subscribes the
+        # account, which Bedrock performs via AWS Marketplace on the caller's
+        # behalf. Without this, new models fail with a marketplace denial.
+        Sid    = "MarketplaceModelSubscription"
+        Effect = "Allow"
+        Action = [
+          "aws-marketplace:ViewSubscriptions",
+          "aws-marketplace:Subscribe"
+        ]
+        Resource = "*"
+        Condition = {
+          StringEquals = {
+            "aws:CalledViaLast" = "bedrock.amazonaws.com"
+          }
+        }
+      },
       {
         Sid    = "BatchDataS3Access"
         Effect = "Allow"