diff --git a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
index 557938f58..d90dcc5e4 100644
--- a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
+++ b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
@@ -18,3 +18,9 @@ spec:
     matchOIDCIdentity:
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
         subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
+      # publish-app.yaml is moving from devantler-tech/reusable-workflows into
+      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
+      # accepted during the transition — drop the reusable-workflows entry once
+      # the first actions-signed artifact has been published and verified.
+      - issuer: '^https://token\.actions\.githubusercontent\.com$'
+        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'
diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml
index 1a54baf85..03834f342 100644
--- a/k8s/bases/apps/github-config/oci-repository.yaml
+++ b/k8s/bases/apps/github-config/oci-repository.yaml
@@ -26,8 +26,14 @@ spec:
     matchOIDCIdentity:
       # Keyless-signed by the shared publish-manifests reusable workflow that
       # .github's cd.yaml calls. Signing runs INSIDE that reusable workflow, so
-      # the cosign OIDC subject is the reusable workflow's path (devantler-tech/
-      # reusable-workflows), NOT .github's own cd.yaml — same convention as the
-      # publish-app.yaml-signed app artifacts.
+      # the cosign OIDC subject is the reusable workflow's path, NOT .github's
+      # own cd.yaml — same convention as the publish-app.yaml-signed app
+      # artifacts. The workflow is moving from devantler-tech/reusable-workflows
+      # into devantler-tech/actions (actions#425 consumer repoint); both
+      # subjects are accepted during the transition — drop the
+      # reusable-workflows entry once the first actions-signed artifact has
+      # been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
         subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-manifests\.yaml@.+$'
+      - issuer: '^https://token\.actions\.githubusercontent\.com$'
+        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-manifests\.yaml@.+$'
diff --git a/k8s/bases/apps/wedding-app/oci-repository.yaml b/k8s/bases/apps/wedding-app/oci-repository.yaml
index 4267ad745..224e79cc3 100644
--- a/k8s/bases/apps/wedding-app/oci-repository.yaml
+++ b/k8s/bases/apps/wedding-app/oci-repository.yaml
@@ -18,3 +18,9 @@ spec:
     matchOIDCIdentity:
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
         subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
+      # publish-app.yaml is moving from devantler-tech/reusable-workflows into
+      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
+      # accepted during the transition — drop the reusable-workflows entry once
+      # the first actions-signed artifact has been published and verified.
+      - issuer: '^https://token\.actions\.githubusercontent\.com$'
+        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'