diff --git a/buildspec.yml b/buildspec.yml
index 42ddba2..fc57156 100644
--- a/buildspec.yml
+++ b/buildspec.yml
@@ -26,6 +26,11 @@ env:
     # Disable TLS verification for Census GHE (Census CA cert not trusted by default)
     GIT_SSL_NO_VERIFY: "true"
     TF_CLI_ARGS: "-no-color"
+    # Census proxy — required for registry.terraform.io provider downloads
+    HTTPS_PROXY: "http://proxy.tco.census.gov:3128"
+    HTTP_PROXY: "http://proxy.tco.census.gov:3128"
+    # Exclude AWS-internal endpoints from the proxy
+    NO_PROXY: "169.254.169.254,169.254.170.2,s3.us-gov-west-1.amazonaws.com,s3.amazonaws.com,.amazonaws.com,.us-gov-west-1.amazonaws.com"
 
 phases:
   install: