diff --git a/.github/nuke_config.yml b/.github/nuke_config.yml
index 7abdb5d6..d370692d 100644
--- a/.github/nuke_config.yml
+++ b/.github/nuke_config.yml
@@ -67,7 +67,18 @@ IAMUsers:
       - "^circle-ci-test$"
 
 IAMGroups:
-  # Delete all groups - no infrastructure groups to protect
+  # IAM groups do not support tags, so the per-repo CircleCI cleanup jobs (which
+  # filter by the gw:repo tag) skip them and they leak until the account hits the
+  # GroupsPerAccount quota (OSS-4024). They are cleaned up here instead.
+  #
+  # Unlike the other resource types in this file, this is an allowlist rather than
+  # a blocklist: only groups matching a known test naming convention are deleted,
+  # so any real group is protected by default. Broaden this list as other repos'
+  # test group names are confirmed.
+  include:
+    names_regex:
+      # terraform-aws-security: "<uniqueId>-test-group-number-N", "test-group-<id>"
+      - "test-group"
 
 IAMRoles:
   exclude:
diff --git a/.github/workflows/nuke-account.yml b/.github/workflows/nuke-account.yml
index 32cee3ac..b0784410 100644
--- a/.github/workflows/nuke-account.yml
+++ b/.github/workflows/nuke-account.yml
@@ -28,7 +28,6 @@ env:
   # Resources excluded across all accounts to prevent breaking infrastructure
   COMMON_EXCLUDES: >-
     --exclude-resource-type iam-user
-    --exclude-resource-type iam-group
     --exclude-resource-type iam-role
     --exclude-resource-type iam-service-linked-role
     --exclude-resource-type oidc-provider