diff --git a/infra/deployments/forms/health/grafana.tf b/infra/deployments/forms/health/grafana.tf
index f157afa9b..6c8140c5a 100644
--- a/infra/deployments/forms/health/grafana.tf
+++ b/infra/deployments/forms/health/grafana.tf
@@ -25,6 +25,7 @@ module "grafana" {
   github_allowed_organizations = var.grafana_settings.github_allowed_organizations
   github_admin_team            = var.grafana_settings.github_admin_team
   github_editor_teams          = var.grafana_settings.github_editor_teams
+  github_viewer_teams          = var.grafana_settings.github_viewer_teams
   seconds_until_auto_pause     = var.grafana_settings.seconds_until_auto_pause
   rds_maintenance_window       = var.environmental_settings.rds_maintenance_window
 
diff --git a/infra/deployments/forms/inputs.tf b/infra/deployments/forms/inputs.tf
index 4a0fd801c..a936df8c9 100644
--- a/infra/deployments/forms/inputs.tf
+++ b/infra/deployments/forms/inputs.tf
@@ -240,9 +240,10 @@ variable "grafana_settings" {
     enabled                      = optional(bool, false)
     cpu                          = number
     memory                       = number
-    github_allowed_organizations = list(string) # GitHub organisations whose members may sign in
-    github_admin_team            = string       # GitHub team (org/team) granted Grafana server admin
-    github_editor_teams          = list(string) # GitHub teams (org/team) granted the Editor role; other org members are denied
+    github_allowed_organizations = list(string)               # GitHub organisations whose members may sign in
+    github_admin_team            = string                     # GitHub team (org/team) granted Grafana server admin
+    github_editor_teams          = list(string)               # GitHub teams (org/team) granted the Editor role
+    github_viewer_teams          = optional(list(string), []) # GitHub teams (org/team) granted the Viewer role; members of no listed team are denied
     seconds_until_auto_pause     = optional(number, 3600)
   })
   nullable = false
diff --git a/infra/deployments/forms/tfvars/dev.tfvars b/infra/deployments/forms/tfvars/dev.tfvars
index a94919714..8248ed711 100644
--- a/infra/deployments/forms/tfvars/dev.tfvars
+++ b/infra/deployments/forms/tfvars/dev.tfvars
@@ -135,4 +135,5 @@ grafana_settings = {
   github_allowed_organizations = ["govuk-forms"]
   github_admin_team            = "govuk-forms/govuk-forms-infrastructure"
   github_editor_teams          = ["govuk-forms/govuk-forms-devs"]
+  github_viewer_teams          = ["govuk-forms/govuk-forms-all"]
 }
diff --git a/infra/deployments/forms/tfvars/production.tfvars b/infra/deployments/forms/tfvars/production.tfvars
index d5fe59cf1..43a14f885 100644
--- a/infra/deployments/forms/tfvars/production.tfvars
+++ b/infra/deployments/forms/tfvars/production.tfvars
@@ -192,4 +192,5 @@ grafana_settings = {
   github_allowed_organizations = ["govuk-forms"]
   github_admin_team            = "govuk-forms/govuk-forms-infrastructure"
   github_editor_teams          = ["govuk-forms/govuk-forms-devs"]
+  github_viewer_teams          = ["govuk-forms/govuk-forms-all"]
 }
diff --git a/infra/deployments/forms/tfvars/staging.tfvars b/infra/deployments/forms/tfvars/staging.tfvars
index 81b5186dc..853912fbd 100644
--- a/infra/deployments/forms/tfvars/staging.tfvars
+++ b/infra/deployments/forms/tfvars/staging.tfvars
@@ -100,4 +100,5 @@ grafana_settings = {
   github_allowed_organizations = ["govuk-forms"]
   github_admin_team            = "govuk-forms/govuk-forms-infrastructure"
   github_editor_teams          = ["govuk-forms/govuk-forms-devs"]
+  github_viewer_teams          = ["govuk-forms/govuk-forms-all"]
 }
diff --git a/infra/modules/grafana/README.md b/infra/modules/grafana/README.md
index c457ee657..6834bd413 100644
--- a/infra/modules/grafana/README.md
+++ b/infra/modules/grafana/README.md
@@ -13,7 +13,8 @@ Users sign in with GitHub and are sent straight to GitHub when they visit
 Grafana. Access is limited to members of the organisations in
 `github_allowed_organizations`, and a role is assigned from team membership:
 `github_admin_team` members are Grafana server admins, `github_editor_teams`
-members are editors, and anybody else is refused.
+members are editors, `github_viewer_teams` members are viewers, and anybody
+else is refused.
 
 The built-in `admin` user remains for use when GitHub sign in is unavailable.
 Its password is in the SSM parameter `/grafana/admin-password` and the login
diff --git a/infra/modules/grafana/ecs.tf b/infra/modules/grafana/ecs.tf
index 525fa473f..d280c5cd8 100644
--- a/infra/modules/grafana/ecs.tf
+++ b/infra/modules/grafana/ecs.tf
@@ -5,7 +5,8 @@ locals {
   # Grafana teams are exposed to the role mapping as "@<org>/<team>"
   github_role_attribute_path = join(" || ", concat(
     ["contains(groups[*], '@${var.github_admin_team}') && 'GrafanaAdmin'"],
-    [for team in var.github_editor_teams : "contains(groups[*], '@${team}') && 'Editor'"]
+    [for team in var.github_editor_teams : "contains(groups[*], '@${team}') && 'Editor'"],
+    [for team in var.github_viewer_teams : "contains(groups[*], '@${team}') && 'Viewer'"]
   ))
 
   environment_variables = [
diff --git a/infra/modules/grafana/variables.tf b/infra/modules/grafana/variables.tf
index d40505fbb..a42a93c3b 100644
--- a/infra/modules/grafana/variables.tf
+++ b/infra/modules/grafana/variables.tf
@@ -68,6 +68,12 @@ variable "github_editor_teams" {
   type        = list(string)
 }
 
+variable "github_viewer_teams" {
+  description = "GitHub teams (org/team) whose members are Grafana viewers"
+  type        = list(string)
+  default     = []
+}
+
 variable "seconds_until_auto_pause" {
   description = "How long the database must be idle before it pauses"
   type        = number