diff --git a/fcvm-fleet.tf b/fcvm-fleet.tf
index e4569122..8a6b79a7 100644
--- a/fcvm-fleet.tf
+++ b/fcvm-fleet.tf
@@ -564,10 +564,13 @@ resource "aws_iam_role_policy" "fcvm_fleet_coordinator_task" {
         "arn:aws:autoscaling:${r}:${local.fcvm_fleet_account_id}:autoScalingGroup:*:autoScalingGroupName/${g}"]])
       },
       {
-        # Reading the groups' instances while waking. DescribeAutoScalingGroups takes no resource-level permission.
+        # Reading the groups' instances while they come up, and their scaling activities: a failed spot launch (Auto
+        # Scaling records UnfulfillableCapacity or MaxSpotInstanceCountExceeded about 10 s after the raise) moves the
+        # wake to the on-demand group at once instead of after --spot-wait (ejc3/fcvm#1263). Neither Describe takes a
+        # resource-level permission.
         Sid      = "DescribeTheHostGroups"
         Effect   = "Allow"
-        Action   = "autoscaling:DescribeAutoScalingGroups"
+        Action   = ["autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScalingActivities"]
         Resource = "*"
       },
       {
diff --git a/scripts/test-fcvm-fleet.py b/scripts/test-fcvm-fleet.py
index c140ef10..5b333f00 100644
--- a/scripts/test-fcvm-fleet.py
+++ b/scripts/test-fcvm-fleet.py
@@ -219,7 +219,7 @@ def test_the_coordinator_scales_only_the_host_groups(self):
         self.assertIn('[for g in ["fcvm-fleet-hosts", "fcvm-fleet-hosts-on-demand"] :', s)
         self.assertNotIn('Resource = "*"', s)
         d = self.stmt("DescribeTheHostGroups")
-        self.assertIn('Action   = "autoscaling:DescribeAutoScalingGroups"', d)
+        self.assertIn('Action   = ["autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScalingActivities"]', d)
         self.assertNotRegex(self.TF, r'"autoscaling:\*"')
         group = block('resource "aws_autoscaling_group" "hosts"', MOD)
         self.assertIn("ignore_changes = [desired_capacity]", group)