diff --git a/lambda/scope/tests/scripts/assume_role_lib.bats b/lambda/scope/tests/scripts/assume_role_lib.bats
index 2428799..e8129f5 100644
--- a/lambda/scope/tests/scripts/assume_role_lib.bats
+++ b/lambda/scope/tests/scripts/assume_role_lib.bats
@@ -129,7 +129,7 @@ JSON='{"attributes":{"iam_role_arns":{"arns":[{"selector":"s3","arn":"arn:aws:ia
 @test "resolve_assume_role_arn: IAM provider when no env override" {
   np() {
     case "$*" in
-      *"--specification_slug aws-iam-configuration"*) echo '{"results":[{"id":"iam-1"}]}' ;;
+      *"--categories identity-access-control"*) echo '{"results":[{"id":"iam-1"}]}' ;;
       *"provider read"*) echo '{"attributes":{"iam_role_arns":{"arns":[{"selector":"lambda","arn":"arn:provider:lambda"}]}}}' ;;
       *) echo '{}' ;;
     esac
@@ -143,7 +143,7 @@ JSON='{"attributes":{"iam_role_arns":{"arns":[{"selector":"s3","arn":"arn:aws:ia
 @test "resolve_assume_role_arn: scope-config fallback when provider misses" {
   np() {
     case "$*" in
-      *"--specification_slug aws-iam-configuration"*) echo '{"results":[]}' ;;
+      *"--categories identity-access-control"*) echo '{"results":[]}' ;;
       *"--categories scope-configurations"*) echo '{"results":[{"attributes":{"assume_role":{"arn":"arn:scopecfg:legacy"}}}]}' ;;
       *) echo '{}' ;;
     esac
diff --git a/lambda/specs/requirements/main.tf b/lambda/specs/requirements/main.tf
index e9971bf..d51e79e 100644
--- a/lambda/specs/requirements/main.tf
+++ b/lambda/specs/requirements/main.tf
@@ -100,6 +100,7 @@ resource "aws_iam_policy" "nullplatform_lambda_iam_policy" {
           "iam:CreateRole",
           "iam:GetRole",
           "iam:DeleteRole",
+          "iam:ListInstanceProfilesForRole",
           "iam:PutRolePolicy",
           "iam:GetRolePolicy",
           "iam:DeleteRolePolicy",
diff --git a/lambda/utils/assume_role_lib b/lambda/utils/assume_role_lib
index 7f2b503..b216011 100644
--- a/lambda/utils/assume_role_lib
+++ b/lambda/utils/assume_role_lib
@@ -32,9 +32,11 @@ provider_arn_for_selector() {
   [ -n "$selector" ] || return 0
 
   local pid data
+  # Filter by category: the API ignores --specification_slug and returns every
+  # provider under the nrn, so "first" would pick an unrelated one.
   pid=$(np provider list --nrn "$nrn" \
-          --specification_slug aws-iam-configuration \
-          --format json --limit 100 2>/dev/null \
+          --categories identity-access-control \
+          --format json 2>/dev/null \
         | jq -r '[ (.results // [])[] ] | first | .id // ""' 2>/dev/null)
   [ -n "$pid" ] && [ "$pid" != "null" ] || return 0