diff --git a/docs/cloud-run-cicd.md b/docs/cloud-run-cicd.md
index 88fb700..d71d5c1 100644
--- a/docs/cloud-run-cicd.md
+++ b/docs/cloud-run-cicd.md
@@ -27,7 +27,11 @@ GitHub OIDC tokens matching repository ID `1355476075`, owner ID `114119117`,
 repository `souravC01/JobHelperGuru`, branch `refs/heads/main`, event `push`, and
 workflow `souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main`.
 The deployer impersonation binding additionally requires the exact main-branch
-OIDC subject. Pull requests, forks, other branches, manual dispatches, and other
+OIDC subject `repo:souravC01@114119117/JobHelperGuru@1355476075:ref:refs/heads/main`.
+This repository uses GitHub's immutable subject format. Check
+`gh api repos/souravC01/JobHelperGuru/actions/oidc/customization/sub` before
+recreating federation; a name-only subject will be rejected even when all other
+claims match. Pull requests, forks, other branches, manual dispatches, and other
 workflow files cannot use this provider. No service-account JSON keys or new
 GitHub secrets are needed. The provider identifier and account email in the
 workflow are public configuration.
diff --git a/scripts/setup-cloud-run-cicd.sh b/scripts/setup-cloud-run-cicd.sh
index c980722..365d8f6 100644
--- a/scripts/setup-cloud-run-cicd.sh
+++ b/scripts/setup-cloud-run-cicd.sh
@@ -9,6 +9,7 @@ pool=jobhelperguru-github
 provider=github-main
 deployer=jobhelperguru-github-deployer@jobhelperguru.iam.gserviceaccount.com
 runtime=jobhelperguru-runner@jobhelperguru.iam.gserviceaccount.com
+subject='repo:souravC01@114119117/JobHelperGuru@1355476075:ref:refs/heads/main'
 
 actual_number=$(gcloud projects describe "$project" --format='value(projectNumber)')
 [[ "$actual_number" == "$project_number" ]] || { echo 'Unexpected project number'; exit 1; }
@@ -28,7 +29,7 @@ gcloud iam workload-identity-pools create "$pool" \
 
 # Numeric IDs prevent a renamed or recreated repository or owner from inheriting
 # access. Also require the exact repository, branch, event, and workflow file.
-condition="assertion.repository_id == '1355476075' && assertion.repository_owner_id == '114119117' && assertion.repository == 'souravC01/JobHelperGuru' && assertion.ref == 'refs/heads/main' && assertion.event_name == 'push' && assertion.workflow_ref == 'souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main' && assertion.sub == 'repo:souravC01/JobHelperGuru:ref:refs/heads/main'"
+condition="assertion.repository_id == '1355476075' && assertion.repository_owner_id == '114119117' && assertion.repository == 'souravC01/JobHelperGuru' && assertion.ref == 'refs/heads/main' && assertion.event_name == 'push' && assertion.workflow_ref == 'souravC01/JobHelperGuru/.github/workflows/ci.yml@refs/heads/main' && assertion.sub == '$subject'"
 gcloud iam workload-identity-pools providers create-oidc "$provider" \
   --project="$project" --location=global --workload-identity-pool="$pool" \
   --display-name='GitHub main CI workflow' \
@@ -38,7 +39,7 @@ gcloud iam workload-identity-pools providers create-oidc "$provider" \
 
 gcloud iam service-accounts add-iam-policy-binding "$deployer" \
   --project="$project" --role=roles/iam.workloadIdentityUser \
-  --member="principal://iam.googleapis.com/projects/$project_number/locations/global/workloadIdentityPools/$pool/subject/repo:souravC01/JobHelperGuru:ref:refs/heads/main" \
+  --member="principal://iam.googleapis.com/projects/$project_number/locations/global/workloadIdentityPools/$pool/subject/$subject" \
   --condition=None
 gcloud artifacts repositories add-iam-policy-binding jobhelperguru \
   --project="$project" --location="$region" \