diff --git a/cdk/lib/__snapshots__/index.test.ts.snap b/cdk/lib/__snapshots__/index.test.ts.snap
index 3c2f87c8b..b893d8d33 100644
--- a/cdk/lib/__snapshots__/index.test.ts.snap
+++ b/cdk/lib/__snapshots__/index.test.ts.snap
@@ -2294,6 +2294,7 @@ EOF
             ],
             "CachePolicyId": "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
             "Compress": true,
+            "OriginRequestPolicyId": "216adef6-5c7f-47e4-b989-5492eafa07d3",
             "TargetOriginId": "typerightertyperightercloudfrontOrigin1DFFB56FA",
             "ViewerProtocolPolicy": "allow-all",
           },
diff --git a/cdk/lib/index.ts b/cdk/lib/index.ts
index dae706f4e..d38b8a07c 100644
--- a/cdk/lib/index.ts
+++ b/cdk/lib/index.ts
@@ -3,7 +3,6 @@ import {
   Duration,
   RemovalPolicy,
   SecretValue,
-  Tags,
 } from "aws-cdk-lib";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import type { GuStackProps } from "@guardian/cdk/lib/constructs/core/stack";
@@ -22,12 +21,10 @@ import { InstanceType, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { GuS3Bucket } from "@guardian/cdk/lib/constructs/s3";
 import {
   AllowedMethods,
-  CacheCookieBehavior,
-  CacheHeaderBehavior,
   CachePolicy,
-  CacheQueryStringBehavior,
   Distribution,
   OriginProtocolPolicy,
+  OriginRequestPolicy,
 } from "aws-cdk-lib/aws-cloudfront";
 import { LoadBalancerV2Origin } from "aws-cdk-lib/aws-cloudfront-origins";
 import {
@@ -225,7 +222,8 @@ EOF
         defaultBehavior: {
           origin: checkerOrigin,
           allowedMethods: AllowedMethods.ALLOW_ALL,
-          cachePolicy: CachePolicy.CACHING_DISABLED
+          cachePolicy: CachePolicy.CACHING_DISABLED,
+          originRequestPolicy: OriginRequestPolicy.ALL_VIEWER
         },
         domainNames: [checkerDomain],
         logBucket: cloudfrontBucket,