diff --git a/data.tf b/data.tf
index 3e28a7c..95f22b3 100644
--- a/data.tf
+++ b/data.tf
@@ -70,6 +70,10 @@ locals {
   )
 }
 
+data "aws_lambda_layer_version" "this" {
+  layer_version_arn = local.default_layer_arn
+}
+
 # Deprecation warnings for conflicting API key configurations.
 # These will become hard validation errors in a future major release.
 check "dd_api_key_not_used_with_secret_arn" {
diff --git a/main.tf b/main.tf
index 4847a30..1e0139f 100644
--- a/main.tf
+++ b/main.tf
@@ -199,7 +199,7 @@ resource "aws_lambda_function" "forwarder" {
   description   = "Pushes logs, metrics and traces from AWS to Datadog."
   role          = local.iam_role_arn
   handler       = "lambda_function.lambda_handler"
-  runtime       = var.layer_version == "latest" ? "python3.14" : (can(tonumber(var.layer_version)) && tonumber(var.layer_version) >= 94 ? "python3.14" : "python3.13")
+  runtime       = reverse(sort(tolist(data.aws_lambda_layer_version.this.compatible_runtimes)))[0]
   architectures = ["arm64"]
   memory_size   = var.memory_size
   timeout       = var.timeout
diff --git a/tests/create_api_key_secret_flag.tftest.hcl b/tests/create_api_key_secret_flag.tftest.hcl
index 2953a22..3d1395a 100644
--- a/tests/create_api_key_secret_flag.tftest.hcl
+++ b/tests/create_api_key_secret_flag.tftest.hcl
@@ -23,6 +23,14 @@ mock_provider "aws" {
       dns_suffix = "amazonaws.com"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/default_config.tftest.hcl b/tests/default_config.tftest.hcl
index f7f8c96..ca627a2 100644
--- a/tests/default_config.tftest.hcl
+++ b/tests/default_config.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
@@ -188,4 +196,3 @@ run "environment_variables_test" {
     error_message = "DD_API_KEY_SSM_NAME should not be present when using Secrets Manager"
   }
 }
-
diff --git a/tests/enhanced_features.tftest.hcl b/tests/enhanced_features.tftest.hcl
index df29309..078849e 100644
--- a/tests/enhanced_features.tftest.hcl
+++ b/tests/enhanced_features.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/enrich_fetch_variables.tftest.hcl b/tests/enrich_fetch_variables.tftest.hcl
index 5a625a8..e96d1ca 100644
--- a/tests/enrich_fetch_variables.tftest.hcl
+++ b/tests/enrich_fetch_variables.tftest.hcl
@@ -22,6 +22,14 @@ mock_provider "aws" {
       arn = "arn:aws:s3:::existing-datadog-bucket"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/existing_iam_role_without_bucket.tftest.hcl b/tests/existing_iam_role_without_bucket.tftest.hcl
index 8beda8b..7019b8e 100644
--- a/tests/existing_iam_role_without_bucket.tftest.hcl
+++ b/tests/existing_iam_role_without_bucket.tftest.hcl
@@ -20,6 +20,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: existing IAM role with SSM parameter (no bucket specified) - should work
diff --git a/tests/existing_resources.tftest.hcl b/tests/existing_resources.tftest.hcl
index e1c0a78..69f523b 100644
--- a/tests/existing_resources.tftest.hcl
+++ b/tests/existing_resources.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/forwarder_version_tag.tftest.hcl b/tests/forwarder_version_tag.tftest.hcl
index e224195..719fdef 100644
--- a/tests/forwarder_version_tag.tftest.hcl
+++ b/tests/forwarder_version_tag.tftest.hcl
@@ -17,6 +17,16 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.12",
+        "python3.14",
+        "python3.13"
+      ]
+    }
+  }
 }
 
 variables {
@@ -45,6 +55,12 @@ run "version_tag_with_latest" {
     condition     = local.forwarder_version != null
     error_message = "local.forwarder_version should be set when using latest"
   }
+
+  # Layer runtime should be set to the latest version of compatible_runtimes
+  assert {
+    condition     = aws_lambda_function.forwarder.runtime == "python3.14"
+    error_message = "Lambda runtime should be python3.14"
+  }
 }
 
 # Test with specific layer_version
@@ -55,6 +71,15 @@ run "version_tag_with_specific_layer" {
     layer_version = "92"
   }
 
+  override_data {
+    target = data.aws_lambda_layer_version.this
+    values = {
+      compatible_runtimes = [
+        "python3.13",
+      ]
+    }
+  }
+
   # Lambda should have dd_forwarder_version tag
   assert {
     condition     = contains(keys(aws_lambda_function.forwarder.tags), "dd_forwarder_version")
@@ -72,6 +97,12 @@ run "version_tag_with_specific_layer" {
     condition     = can(regex(":92$", aws_lambda_function.forwarder.layers[0]))
     error_message = "Lambda layer ARN should end with :92"
   }
+
+  # Runtime should match the compatible_runtimes returned by the layer data source
+  assert {
+    condition     = aws_lambda_function.forwarder.runtime == "python3.13"
+    error_message = "Lambda runtime should be python3.13"
+  }
 }
 
 # Test that user tags are preserved alongside dd_forwarder_version
@@ -102,4 +133,3 @@ run "version_tag_with_user_tags" {
     error_message = "dd_forwarder_version tag should be added alongside user tags"
   }
 }
-
diff --git a/tests/multi_region.tftest.hcl b/tests/multi_region.tftest.hcl
index fb435eb..30c7754 100644
--- a/tests/multi_region.tftest.hcl
+++ b/tests/multi_region.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/optional_env_vars.tftest.hcl b/tests/optional_env_vars.tftest.hcl
index 31889ad..04b58f7 100644
--- a/tests/optional_env_vars.tftest.hcl
+++ b/tests/optional_env_vars.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
diff --git a/tests/s3_log_bucket_arns.tftest.hcl b/tests/s3_log_bucket_arns.tftest.hcl
index cd296b3..2afb87e 100644
--- a/tests/s3_log_bucket_arns.tftest.hcl
+++ b/tests/s3_log_bucket_arns.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: Default behavior - s3:GetObject should allow all buckets for backward compatibility
diff --git a/tests/secrets_management.tftest.hcl b/tests/secrets_management.tftest.hcl
index e02303c..4fab857 100644
--- a/tests/secrets_management.tftest.hcl
+++ b/tests/secrets_management.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Path 1: dd_api_key only (auto-create secret)
diff --git a/tests/sqs_failed_events.tftest.hcl b/tests/sqs_failed_events.tftest.hcl
index c178b8c..ee35e19 100644
--- a/tests/sqs_failed_events.tftest.hcl
+++ b/tests/sqs_failed_events.tftest.hcl
@@ -18,6 +18,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: SQS URL auto-enables DD_STORE_FAILED_EVENTS and skips S3 bucket creation
diff --git a/tests/vpc_config.tftest.hcl b/tests/vpc_config.tftest.hcl
index bb54f0a..c2c85da 100644
--- a/tests/vpc_config.tftest.hcl
+++ b/tests/vpc_config.tftest.hcl
@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {