diff --git a/src/cmd/cli/command/compose.go b/src/cmd/cli/command/compose.go
index 3d9fcbf34..ce6aec5de 100644
--- a/src/cmd/cli/command/compose.go
+++ b/src/cmd/cli/command/compose.go
@@ -338,8 +338,17 @@ func makeComposeDownCmd() *cobra.Command {
 				Verbose:            verbose,
 				LogType:            logs.LogTypeAll,
 			}
-			err = cli.Tail(cmd.Context(), provider, projectName, tailOptions)
+			tailCtx := cmd.Context()
+			err = cli.Tail(tailCtx, provider, projectName, tailOptions)
 			if err != nil {
+				if connect.CodeOf(err) == connect.CodePermissionDenied {
+					// If tail fails because of missing permission, we show a warning and detach. This is
+					// different than `up`, which will wait for the deployment to finish, but we don't have an
+					// ECS event subscription for `down` so we can't wait for the deployment to finish.
+					// Instead, we'll just show a warning and detach.
+					term.Warn("Unable to tail logs. Detaching.")
+					return nil
+				}
 				return err
 			}
 			term.Info("Done.")
diff --git a/src/pkg/scope/scope.go b/src/pkg/scope/scope.go
index 886da68f4..0b3eb36ad 100644
--- a/src/pkg/scope/scope.go
+++ b/src/pkg/scope/scope.go
@@ -15,5 +15,5 @@ func (s Scope) String() string {
 }
 
 func All() []Scope {
-	return []Scope{Admin, Delete, Read, Tail, Delete}
+	return []Scope{Admin, Delete, Read, Tail}
 }
diff --git a/src/protos/io/defang/v1/fabric.pb.go b/src/protos/io/defang/v1/fabric.pb.go
index 0a56fbd05..4463d8d7f 100644
--- a/src/protos/io/defang/v1/fabric.pb.go
+++ b/src/protos/io/defang/v1/fabric.pb.go
@@ -2,7 +2,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.1
+// 	protoc-gen-go v1.36.2
 // 	protoc        (unknown)
 // source: io/defang/v1/fabric.proto