diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index b096864..c210ed0 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1405,7 +1405,9 @@ Resources:
               StringLike:
                 token.actions.githubusercontent.com:sub:
                   - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:pull_request
+                  # use_immutable_subject is false, so pull_request tokens use
+                  # repo:ORG/seahaven-org-baseline:ref:refs/pull/N/merge.
+                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/pull/*
       Policies:
         - PolicyName: access-analyzer-policy-check
           PolicyDocument: