diff --git a/environment/deployments/data-curation/env/production.tfvars b/environment/deployments/data-curation/env/production.tfvars
index 61031bf8..3e6be2f4 100644
--- a/environment/deployments/data-curation/env/production.tfvars
+++ b/environment/deployments/data-curation/env/production.tfvars
@@ -91,4 +91,4 @@ git_lfs_ro_dev_service_accounts = [
 ]
 
 # Increase this number to force Terraform to update the production environment.
-# Serial: 5
+# Serial: 6
diff --git a/environment/deployments/data-curation/main.tf b/environment/deployments/data-curation/main.tf
index 803f18ec..2578c574 100644
--- a/environment/deployments/data-curation/main.tf
+++ b/environment/deployments/data-curation/main.tf
@@ -255,15 +255,17 @@ resource "google_storage_bucket_iam_member" "data_curation_prod_rw_dp0" {
 }
 // RO storage access to DESC DC2 Run22i bucket
 resource "google_storage_bucket_iam_member" "data_curation_prod_ro_desc_dc2_run22i" {
-  bucket = "curation-us-central1-desc-dc2-run22i"
-  role   = "roles/storage.objectViewer"
-  member = "serviceAccount:${module.data_curation_prod_accounts.email}"
+  for_each = toset(["roles/storage.objectViewer", "roles/storage.legacyBucketReader"])
+  bucket   = "curation-us-central1-desc-dc2-run22i"
+  role     = each.value
+  member   = "serviceAccount:${module.data_curation_prod_accounts.email}"
 }
 // RO storage access to DESC DR6 bucket
 resource "google_storage_bucket_iam_member" "data_curation_prod_ro_desc_dr6" {
-  bucket = "butler-us-central1-dp01-desc-dr6"
-  role   = "roles/storage.objectViewer"
-  member = "serviceAccount:${module.data_curation_prod_accounts.email}"
+  for_each = toset(["roles/storage.objectViewer", "roles/storage.legacyBucketReader"])
+  bucket   = "butler-us-central1-dp01-desc-dr6"
+  role     = each.value
+  member   = "serviceAccount:${module.data_curation_prod_accounts.email}"
 }
 // RW storage access to the -dev Butler bucket
 resource "google_storage_bucket_iam_member" "data_curation_prod_rw_dp0_dev" {