diff --git a/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml b/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
index 0b1fcfee7..a6aff95b8 100644
--- a/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
+++ b/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
@@ -167,8 +167,15 @@ spec:
           verify:
             provider: cosign
             matchOIDCIdentity:
+              # publish-app.yaml is moving from devantler-tech/reusable-workflows into
+              # devantler-tech/actions (actions#425 consumer repoint); both repo
+              # subjects are accepted via ONE regex-alternated entry — cosign's keyless
+              # attestation verification rejects MULTIPLE identity entries outright
+              # ("unsupported: multiple identities are not supported at this time").
+              # Narrow the alternation to actions-only once the first actions-signed
+              # artifact has been published and verified.
               - issuer: '^https://token\.actions\.githubusercontent\.com$'
-                subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
+                subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'
     # --- Flux Kustomization (one of two variants by `sops`) ---------------
     # The impersonating Kustomization that reconciles the tenant's own artifact
     # under its namespaced `edit` SA. Two variants because the SOPS `decryption`