diff --git a/.github/risk-paths.yml b/.github/risk-paths.yml
index 4590f4f..b42b3ba 100644
--- a/.github/risk-paths.yml
+++ b/.github/risk-paths.yml
@@ -26,7 +26,7 @@ blocked:
   - '.github/workflows/**'
   - '.github/risk-paths.yml'
   - '.github/CODEOWNERS'
-  - 'infra/**'
+  - 'infra/iam/**'  # narrowed 2026-05-22 (was 'infra/**' — over-classified safe IaC sync PRs)
   - 'terraform/**'
   - 'k8s/**'
 
@@ -88,4 +88,4 @@ trivial:
   - 'LICENSE'
   - '.gitignore'
   - '.github/ISSUE_TEMPLATE/**'
-  - 'docs/**'
+  - 'docs/**'
\ No newline at end of file