diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index a25e3ed..82d1d21 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -35,6 +35,10 @@ on:
         description: "CloudFormation stack name (for pre-flight checks)"
         type: string
         default: ""
+      stacks:
+        description: "CDK stack selector(s) to deploy (space-separated construct ids/patterns). Default deploys every stack in the app; set per job when a multi-account app splits deploys across roles."
+        type: string
+        default: "--all"
       post-deploy-script:
         description: "Optional path to a script to run after CDK deploy (e.g. web build, S3 sync)"
         type: string
@@ -121,7 +125,12 @@ jobs:
 
       - name: CDK deploy
         working-directory: ${{ inputs.cdk-dir }}
-        run: npx -y cdk deploy --all --require-approval never
+        # Env-var indirection (not inline expression interpolation) so shell
+        # metacharacters in the input are never parsed as script; unquoted
+        # $STACKS deliberately word-splits multiple selectors.
+        env:
+          STACKS: ${{ inputs.stacks }}
+        run: npx -y cdk deploy $STACKS --require-approval never
 
       - name: Post-deploy script
         if: ${{ inputs.post-deploy-script != '' }}
diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index 7ab639f..5e44d24 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1247,7 +1247,12 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
+                # Transition pair for the seahaven-account-baseline ->
+                # seahaven-org-baseline repo rename (2026-07-14). The old sub is
+                # removed once a post-rename deploy is verified green.
+                token.actions.githubusercontent.com:sub:
+                  - !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
+                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
       Policies:
         - PolicyName: cdk-deploy
           PolicyDocument: