diff --git a/infra/github/main.tf b/infra/github/main.tf
index d6810bc..1d7054e 100644
--- a/infra/github/main.tf
+++ b/infra/github/main.tf
@@ -15,6 +15,15 @@ resource "github_repository_ruleset" "default_branch" {
     }
   }
 
+  dynamic "bypass_actors" {
+    for_each = var.bypass_actors
+    content {
+      actor_id    = bypass_actors.value.actor_id
+      actor_type  = bypass_actors.value.actor_type
+      bypass_mode = bypass_actors.value.bypass_mode
+    }
+  }
+
   rules {
     deletion            = true
     non_fast_forward    = true
diff --git a/infra/github/variables.tf b/infra/github/variables.tf
index 217dff4..97271ed 100644
--- a/infra/github/variables.tf
+++ b/infra/github/variables.tf
@@ -37,3 +37,20 @@ variable "ruleset_name" {
   type        = string
   default     = "default-branch-protection"
 }
+
+variable "bypass_actors" {
+  description = <<-EOT
+    Actors permitted to bypass the ruleset. Each entry needs:
+      - actor_id: numeric ID (for built-in repo roles: 1=read, 2=triage,
+        3=write, 4=maintain, 5=admin)
+      - actor_type: one of RepositoryRole, Team, Integration,
+        OrganizationAdmin, DeployKey
+      - bypass_mode: "always" or "pull_request"
+  EOT
+  type = list(object({
+    actor_id    = number
+    actor_type  = string
+    bypass_mode = string
+  }))
+  default = []
+}