I've got a classic email template that's run as an email alert from a flow that iterates records and sends email to a related contact. Works great.

I want to change the classic email tamplated to a VisualForce email template so that I can have better formatting and conditional content.. I created the Visual email template, which runs fine from the template builder.  

I switched the email alert to the new template, tested the flow, and received the following error message:

HED__COURSE_ENROLLMENT__C.CONNECTION_WAIVER_EMAIL (EMAIL ALERTS): Send Waiver Email
Inputs:
SObjectRowId = {!Iterate_Course_Connections.Id} (a0V8C0000006Bm9UAE)

Error Occurred: We were unable to process the email template. Error Message: core.email.template.TemplateRenderingException: Read access denied for hed__Course_Enrollment__c, controller action methods may not execute.

Thoughts on what's going wrong?  Thanks!