diff --git a/infrastructure/05-cloudrun-deploy.sh b/infrastructure/05-cloudrun-deploy.sh
index fbd7852..b515a80 100644
--- a/infrastructure/05-cloudrun-deploy.sh
+++ b/infrastructure/05-cloudrun-deploy.sh
@@ -19,6 +19,7 @@ fi
 REPO="${REGION}-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
 IMAGE="${REPO}/osvauco-agent:latest"
 AGENT_PATH="${SCRIPT_DIR}/../agents/core-logic"
+AGENT_SA_NAME=$(echo "${AGENT_SA}" | cut -d@ -f1)
 
 echo "=== 05: Cloud Run Deploy ==="
 
@@ -29,19 +30,40 @@ gcloud services enable \
   run.googleapis.com \
   artifactregistry.googleapis.com \
   cloudbuild.googleapis.com \
+  iam.googleapis.com \
   --project="${PROJECT_ID}" --quiet
 
-# Resolve caller identity
-CALLER=$(gcloud config get-value account 2>/dev/null)
-echo "ℹ️  Deploying as: ${CALLER}"
+# Create agent service account if it doesn't exist (idempotent)
+if ! gcloud iam service-accounts describe "${AGENT_SA}" \
+     --project="${PROJECT_ID}" &>/dev/null; then
+  gcloud iam service-accounts create "${AGENT_SA_NAME}" \
+    --display-name="OSVauco Agent SA" \
+    --project="${PROJECT_ID}"
+  echo "✓ Service account created: ${AGENT_SA}"
+else
+  echo "✓ Service account already exists: ${AGENT_SA}"
+fi
 
-# Grant caller permission to act as the agent service account
-# (required for gcloud run deploy --service-account=...)
+# Grant the SA roles it needs at runtime
+for ROLE in \
+  roles/aiplatform.user \
+  roles/secretmanager.secretAccessor \
+  roles/logging.logWriter \
+  roles/cloudtrace.agent \
+  roles/monitoring.metricWriter; do
+  gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${AGENT_SA}" \
+    --role="${ROLE}" --quiet
+done
+echo "✓ Runtime roles granted to ${AGENT_SA}"
+
+# Grant caller iam.serviceAccountUser on the SA (needed for --service-account flag)
+CALLER=$(gcloud config get-value account 2>/dev/null)
 gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \
   --member="user:${CALLER}" \
   --role="roles/iam.serviceAccountUser" \
   --project="${PROJECT_ID}" --quiet
-echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}"
+echo "✓ iam.serviceAccountUser granted to ${CALLER}"
 
 # Create Artifact Registry repo if it doesn't exist
 gcloud artifacts repositories describe osvauco-repo \
@@ -61,12 +83,12 @@ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
 gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
   --member="serviceAccount:${COMPUTE_SA}" \
   --role="roles/secretmanager.secretAccessor" --quiet
-echo "✓ IAM bindings applied"
+echo "✓ Cloud Build IAM bindings applied"
 
 # Configure Docker for Artifact Registry
 gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
 
-# Build image via Cloud Build (no local Docker needed)
+# Build image via Cloud Build
 echo "Building image via Cloud Build..."
 gcloud builds submit "${AGENT_PATH}" \
   --tag="${IMAGE}" \