diff --git a/providers.tf b/providers.tf
index 750bf71..4e4215b 100644
--- a/providers.tf
+++ b/providers.tf
@@ -10,3 +10,10 @@ terraform {
     }
   }
 }
+
+# GITHUB_TOKEN and GITHUB_BASE_URL are injected as env vars by the Lambda.
+# insecure = true is required because the Census GHE TLS certificate is signed
+# by the Census internal CA, which is not in the CodeBuild container trust store.
+provider "github" {
+  insecure = true
+}