Terraform plan fails on PR with 403 despite valid service account

Trying to set up a CI/CD pipeline that runs terraform plan on PR and apply on merge. The plan step fails immediately with 403 Forbidden on the first data source. My service account has the correct scope for routing queues. Here is the error from the logs: Error reading Routing Queue: 403 Forbidden. The token looks valid in the debug output. What am I missing?