diff --git a/tf/deployment/modules/shared/zitadel/cloud/project.tf b/tf/deployment/modules/shared/zitadel/cloud/project.tf
index a91c79de5..89af01d49 100644
--- a/tf/deployment/modules/shared/zitadel/cloud/project.tf
+++ b/tf/deployment/modules/shared/zitadel/cloud/project.tf
@@ -32,7 +32,7 @@ locals {
       # redirectUris intentionally empty for now — add the o11y grafana host
       # (https://<host>/login/generic_oauth) once it's finalised
       redirectUris = ["https://grafana.futostatus.com/login/generic_oauth", "https://grafana.staging.futostatus.com/login/generic_oauth"]
-      roles        = [{ key = "GrafanaAdmin", grants_to = ["immich_admin"] }, { key = "Editor", grants_to = ["team", "yucca"] }]
+      roles        = [{ key = "GrafanaAdmin", grants_to = ["immich_admin"] }, { key = "Editor", grants_to = ["team", "yucca"] }, { key = "Viewer", grants_to = ["futo"] }]
     },
     {
       name = "Outline"