diff --git a/README.md b/README.md
index df5deff..99ec254 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ make mockstack/clean
 | <a name="input_trust_policy"></a> [trust\_policy](#input\_trust\_policy) | JSON string representing the trust policy to apply to the role being updated | `string` | n/a | yes |
 | <a name="input_update_role_name"></a> [update\_role\_name](#input\_update\_role\_name) | Name of the IAM role to update in the target account (case sensitive) | `string` | n/a | yes |
 | <a name="input_event_types"></a> [event\_types](#input\_event\_types) | Event types that will trigger this lambda | `set(string)` | <pre>[<br/>  "CreateAccountResult",<br/>  "InviteAccountToOrganization"<br/>]</pre> | no |
-| <a name="input_lambda"></a> [lambda](#input\_lambda) | Map of any additional arguments for the upstream lambda module. See <https://github.com/terraform-aws-modules/terraform-aws-lambda> | <pre>object({<br/>    artifacts_dir            = optional(string, "builds")<br/>    create_package           = optional(bool, true)<br/>    ephemeral_storage_size   = optional(number)<br/>    ignore_source_code_hash  = optional(bool, true)<br/>    local_existing_package   = optional(string)<br/>    recreate_missing_package = optional(bool, false)<br/>    s3_bucket                = optional(string)<br/>    s3_existing_package      = optional(map(string))<br/>    s3_prefix                = optional(string)<br/>    store_on_s3              = optional(bool, false)<br/>  })</pre> | `{}` | no |
+| <a name="input_lambda"></a> [lambda](#input\_lambda) | Map of any additional arguments for the upstream lambda module. See <https://github.com/terraform-aws-modules/terraform-aws-lambda> | <pre>object({<br/>    artifacts_dir            = optional(string, "builds")<br/>    create_package           = optional(bool, true)<br/>    ephemeral_storage_size   = optional(number)<br/>    ignore_source_code_hash  = optional(bool, true)<br/>    local_existing_package   = optional(string)<br/>    recreate_missing_package = optional(bool, false)<br/>    runtime                  = optional(string, "python3.12")<br/>    s3_bucket                = optional(string)<br/>    s3_existing_package      = optional(map(string))<br/>    s3_prefix                = optional(string)<br/>    store_on_s3              = optional(bool, false)<br/>  })</pre> | `{}` | no |
 | <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Log level of the lambda output, one of: debug, info, warning, error, critical | `string` | `"info"` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags that are passed to resources | `map(string)` | `{}` | no |
 
diff --git a/main.tf b/main.tf
index ccc18a4..d96e43b 100644
--- a/main.tf
+++ b/main.tf
@@ -28,7 +28,7 @@ module "lambda" {
 
   description = "Update trust policy on IAM Account Role"
   handler     = "new_account_trust_policy.lambda_handler"
-  runtime     = "python3.8"
+  runtime     = var.lambda.runtime
   tags        = var.tags
   timeout     = 300
 
diff --git a/variables.tf b/variables.tf
index ce5184d..69fa19b 100644
--- a/variables.tf
+++ b/variables.tf
@@ -36,6 +36,7 @@ variable "lambda" {
     ignore_source_code_hash  = optional(bool, true)
     local_existing_package   = optional(string)
     recreate_missing_package = optional(bool, false)
+    runtime                  = optional(string, "python3.12")
     s3_bucket                = optional(string)
     s3_existing_package      = optional(map(string))
     s3_prefix                = optional(string)