diff --git a/deploy/main.tf b/deploy/main.tf
index 016844c..3510986 100644
--- a/deploy/main.tf
+++ b/deploy/main.tf
@@ -32,6 +32,7 @@ module "eks_terragrunt_repo_generator" {
   github_api_url     = var.github_api_url
   github_org_name    = var.github_org_name
   template_repo_name = var.template_repo_name
+  repo_visibility    = var.repo_visibility
 
   # GitHub token from Secrets Manager
   github_token = {
diff --git a/deploy/variables.tf b/deploy/variables.tf
index ca39c64..34f015f 100644
--- a/deploy/variables.tf
+++ b/deploy/variables.tf
@@ -25,6 +25,12 @@ variable "github_token_secret_name" {
   type        = string
 }
 
+variable "repo_visibility" {
+  description = "Default visibility for newly created repos. GHE enterprise policies often block 'private'; use 'internal'."
+  type        = string
+  default     = "internal"
+}
+
 variable "image_tag" {
   description = "Tag of the Docker image in ECR"
   type        = string