diff --git a/controlpanel/api/cluster.py b/controlpanel/api/cluster.py
index 2295167c5..23e5b5dda 100644
--- a/controlpanel/api/cluster.py
+++ b/controlpanel/api/cluster.py
@@ -503,7 +503,7 @@ def oidc_provider_statement(self):
         return json.loads(statement)
 
     def create_iam_role(self):
-        assume_role_policy = BASE_ASSUME_ROLE_POLICY.copy()
+        assume_role_policy = deepcopy(BASE_ASSUME_ROLE_POLICY)
         assume_role_policy["Statement"].append(self.oidc_provider_statement)
         self.aws_role_service.create_role(self.iam_role_name, assume_role_policy)
 
diff --git a/tests/api/cluster/test_app.py b/tests/api/cluster/test_app.py
index 6547661ce..bafa396f1 100644
--- a/tests/api/cluster/test_app.py
+++ b/tests/api/cluster/test_app.py
@@ -1,4 +1,5 @@
 # Standard library
+from copy import deepcopy
 from unittest.mock import MagicMock, patch
 
 # Third-party
@@ -76,7 +77,7 @@ def test_oidc_provider_statement(app, oidc_provider_statement):
 
 
 def test_app_create_iam_role(aws_create_role, app, oidc_provider_statement):
-    expected_assume_role = BASE_ASSUME_ROLE_POLICY.copy()
+    expected_assume_role = deepcopy(BASE_ASSUME_ROLE_POLICY)
     expected_assume_role["Statement"].append(oidc_provider_statement)
 
     cluster.App(app).create_iam_role()