diff --git a/docs/docs/reference/networking/tailscale-policy.md b/docs/docs/reference/networking/tailscale-policy.md
index 8b86642..06d25d9 100644
--- a/docs/docs/reference/networking/tailscale-policy.md
+++ b/docs/docs/reference/networking/tailscale-policy.md
@@ -75,10 +75,18 @@ short-lived API token, and no long-lived credential is stored.
 | --- | --- |
 | Credential type | OpenID Connect trust credential |
 | Issuer | GitHub Actions |
-| Subject | `repo:GilmanLab/networking:*` |
+| Subject | `repo:GilmanLab@66194346/networking@1334494603:*` |
 | Scopes | `policy_file`, with `devices:posture_attributes` and `devices:core:read` |
 | Audience | `api.tailscale.com/<client id>` |
 
+The `GilmanLab` organization issues OIDC subjects in GitHub's immutable form,
+with numeric organization and repository IDs rather than
+`repo:GilmanLab/networking:...`. A subject pattern written with plain names
+never matches, and Tailscale rejects the token exchange with HTTP 403 before it
+evaluates scopes. The trailing `*` covers both subject shapes CI produces:
+`:ref:refs/heads/master` for an apply run and `:pull_request` for a validation
+run.
+
 Trust credentials are managed on the
 [Trust credentials](https://login.tailscale.com/admin/settings/trust-credentials)
 page. The node-registration credential used elsewhere in the lab is a separate
diff --git a/docs/docs/runbooks/tailscale-policy-change.md b/docs/docs/runbooks/tailscale-policy-change.md
index d8b7ed5..e978c98 100644
--- a/docs/docs/runbooks/tailscale-policy-change.md
+++ b/docs/docs/runbooks/tailscale-policy-change.md
@@ -113,9 +113,12 @@ emergency edit that is not carried back into git is silently lost.
 
 - Validation fails with an error you cannot interpret: check the
   [policy file syntax reference](https://tailscale.com/docs/reference/syntax/policy-file).
-- The apply step fails to authenticate: inspect the trust credential on the
+- The step fails with `token exchange failed with status 403`: the OIDC token's
+  claims do not match the trust credential. Inspect the credential on the
   [Trust credentials](https://login.tailscale.com/admin/settings/trust-credentials)
-  page, which records the most recent token exchange error, and confirm the
-  repository variables still match the credential.
+  page, which records the most recent token exchange error, and compare its
+  subject against the
+  [expected subject](../reference/networking/tailscale-policy.md#credentials).
+  Confirm the repository variables still match the credential.
 - The apply step fails on a checksum mismatch: someone edited the policy in the
   console. Reconcile that edit into git, then re-run the workflow.