diff --git a/terraform/environments/gcp/compute.tf b/terraform/environments/gcp/compute.tf
index 59847e2d2..d0289d2bf 100644
--- a/terraform/environments/gcp/compute.tf
+++ b/terraform/environments/gcp/compute.tf
@@ -169,9 +169,10 @@ module "compute_gke" {
   database_password_secret_name = module.secrets.database_password_secret_name
 
   # Application configuration
-  admin_email                = var.admin_email
-  admin_password_secret_name = coalesce(module.secrets.admin_password_secret_name, "")
-  auto_migrate               = var.auto_migrate
+  admin_email                  = var.admin_email
+  admin_password_secret_name   = coalesce(module.secrets.admin_password_secret_name, "")
+  enable_admin_password_writer = true # secret name comes from secrets module output, not a literal
+  auto_migrate                 = var.auto_migrate
 
   # Per-secret IAM bindings for the GKE workload SA. Without these the pod
   # could only read `database_password_secret_name`, so any code path
diff --git a/terraform/modules/compute/gcp/gke/main.tf b/terraform/modules/compute/gcp/gke/main.tf
index 271d924fc..61534b33f 100644
--- a/terraform/modules/compute/gcp/gke/main.tf
+++ b/terraform/modules/compute/gcp/gke/main.tf
@@ -263,6 +263,26 @@ resource "google_secret_manager_secret_iam_member" "workload" {
   member    = "serviceAccount:${google_service_account.workload.email}"
 }
 
+# Admin password secret: the app reads it at startup and adds a version when
+# the admin password changes, so the SA needs both roles. No `project`, same
+# reason as `workload`. Gated by a literal bool because the secret name is
+# known only after apply (sensitive-value-in-count).
+resource "google_secret_manager_secret_iam_member" "admin_password_reader" {
+  count = var.enable_admin_password_writer ? 1 : 0
+
+  secret_id = var.admin_password_secret_name
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.workload.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "admin_password_writer" {
+  count = var.enable_admin_password_writer ? 1 : 0
+
+  secret_id = var.admin_password_secret_name
+  role      = "roles/secretmanager.secretVersionAdder"
+  member    = "serviceAccount:${google_service_account.workload.email}"
+}
+
 resource "google_secret_manager_secret_iam_member" "workload_additional" {
   for_each = var.additional_secret_accessor_ids
 
diff --git a/terraform/modules/compute/gcp/gke/variables.tf b/terraform/modules/compute/gcp/gke/variables.tf
index ca0d57a17..a0a3f8945 100644
--- a/terraform/modules/compute/gcp/gke/variables.tf
+++ b/terraform/modules/compute/gcp/gke/variables.tf
@@ -181,6 +181,12 @@ variable "admin_password_secret_name" {
   default     = ""
 }
 
+variable "enable_admin_password_writer" {
+  description = "Grant the workload SA read and version-add access to the admin password secret. Set to true when admin_password_secret_name comes from a resource attribute (known after apply) to avoid sensitive-value-in-count Terraform limitation."
+  type        = bool
+  default     = false
+}
+
 variable "auto_migrate" {
   description = "Automatically run database migrations on startup"
   type        = bool