diff --git a/supabase/functions/buildium-sync/index.ts b/supabase/functions/buildium-sync/index.ts
index e2f88f7..ef49a6d 100644
--- a/supabase/functions/buildium-sync/index.ts
+++ b/supabase/functions/buildium-sync/index.ts
@@ -2096,8 +2096,17 @@ Deno.serve(async (req) => {
     if (syncType === "bills") {
       const { bIdToLocalId } = await getAssociationMaps();
 
-      // 1) Sync vendors so bills can be linked
-      const buildiumVendors = await buildiumFetchAll("/v1/vendors", clientId, clientSecret);
+      // 1) Sync vendors so bills can be linked. The Buildium API key may lack
+      // the Vendors permission (403) — degrade gracefully: import bills without
+      // vendor links instead of failing the whole pull.
+      let buildiumVendors: any[] = [];
+      let vendorsAccessible = true;
+      try {
+        buildiumVendors = await buildiumFetchAll("/v1/vendors", clientId, clientSecret);
+      } catch (e) {
+        vendorsAccessible = false;
+        console.warn(`[bills] vendors fetch failed — continuing without vendor sync: ${e}`);
+      }
       // Paginated fetch so large vendor sets don't get truncated at 1000 rows
       const existingVendors: any[] = [];
       {
@@ -2770,6 +2779,7 @@ Deno.serve(async (req) => {
         payments_held: paymentsHeld,
         checks_created: checksCreated,
         checks_held: checksHeld,
+        ...(vendorsAccessible ? {} : { vendors_unavailable: "Buildium API key lacks the Vendors permission — bills imported without vendor links" }),
       };
 
       await supabase.from("company_settings").upsert(