diff --git a/template.yaml b/template.yaml
index fa0b5d4..c2bb6f6 100644
--- a/template.yaml
+++ b/template.yaml
@@ -300,9 +300,10 @@ Resources:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
                 token.actions.githubusercontent.com:sub: "repo:Sea-Haven-Industries/afterhours-shift-manager:ref:refs/heads/main"
-                # Defense-in-depth: only the release workflow may assume this role,
-                # not any workflow running on main.
-                token.actions.githubusercontent.com:job_workflow_ref: "Sea-Haven-Industries/afterhours-shift-manager/.github/workflows/release.yaml@refs/heads/main"
+                # Defense-in-depth: only the Deploy workflow's release job may assume
+                # this role, not any workflow running on main. (The release job lives
+                # in deploy.yaml; this must match that workflow's path.)
+                token.actions.githubusercontent.com:job_workflow_ref: "Sea-Haven-Industries/afterhours-shift-manager/.github/workflows/deploy.yaml@refs/heads/main"
       Policies:
         - PolicyName: invoke-release-notifier
           PolicyDocument: