diff --git a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
index d90dcc5e4..7ceaca4d0 100644
--- a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
+++ b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
@@ -16,11 +16,11 @@ spec:
   verify:
     provider: cosign
     matchOIDCIdentity:
+      # Flux's cosign verifier accepts exactly ONE identity ("multiple
+      # identities are not supported at this time"), so the actions#425
+      # transition (publish-app.yaml moving from devantler-tech/
+      # reusable-workflows into devantler-tech/actions) is expressed as one
+      # alternation regex — narrow it to the actions path once the first
+      # actions-signed artifact has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
-      # publish-app.yaml is moving from devantler-tech/reusable-workflows into
-      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
-      # accepted during the transition — drop the reusable-workflows entry once
-      # the first actions-signed artifact has been published and verified.
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'
diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml
index 03834f342..98a65d32b 100644
--- a/k8s/bases/apps/github-config/oci-repository.yaml
+++ b/k8s/bases/apps/github-config/oci-repository.yaml
@@ -28,12 +28,11 @@ spec:
       # .github's cd.yaml calls. Signing runs INSIDE that reusable workflow, so
       # the cosign OIDC subject is the reusable workflow's path, NOT .github's
       # own cd.yaml — same convention as the publish-app.yaml-signed app
-      # artifacts. The workflow is moving from devantler-tech/reusable-workflows
-      # into devantler-tech/actions (actions#425 consumer repoint); both
-      # subjects are accepted during the transition — drop the
-      # reusable-workflows entry once the first actions-signed artifact has
-      # been published and verified.
+      # artifacts. Flux's cosign verifier accepts exactly ONE identity
+      # ("multiple identities are not supported at this time"), so the
+      # actions#425 transition (the workflow moving from devantler-tech/
+      # reusable-workflows into devantler-tech/actions) is expressed as one
+      # alternation regex — narrow it to the actions path once the first
+      # actions-signed artifact has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-manifests\.yaml@.+$'
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-manifests\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-manifests\.yaml@.+$'
diff --git a/k8s/bases/apps/wedding-app/oci-repository.yaml b/k8s/bases/apps/wedding-app/oci-repository.yaml
index 224e79cc3..39016d150 100644
--- a/k8s/bases/apps/wedding-app/oci-repository.yaml
+++ b/k8s/bases/apps/wedding-app/oci-repository.yaml
@@ -16,11 +16,11 @@ spec:
   verify:
     provider: cosign
     matchOIDCIdentity:
+      # Flux's cosign verifier accepts exactly ONE identity ("multiple
+      # identities are not supported at this time"), so the actions#425
+      # transition (publish-app.yaml moving from devantler-tech/
+      # reusable-workflows into devantler-tech/actions) is expressed as one
+      # alternation regex — narrow it to the actions path once the first
+      # actions-signed artifact has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
-      # publish-app.yaml is moving from devantler-tech/reusable-workflows into
-      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
-      # accepted during the transition — drop the reusable-workflows entry once
-      # the first actions-signed artifact has been published and verified.
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'