diff --git a/.gitignore b/.gitignore
index 4c78664..e718b15 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@ dist/
 infra/terraform/**/.terraform/
 infra/terraform/**/*.tfstate*
 infra/terraform/**/.terraform.lock.hcl.bak
+.claude/settings.local.json
diff --git a/infra/terraform/bootstrap/main.tf b/infra/terraform/bootstrap/main.tf
index 9f0a9ac..aaff311 100644
--- a/infra/terraform/bootstrap/main.tf
+++ b/infra/terraform/bootstrap/main.tf
@@ -227,7 +227,7 @@ resource "aws_iam_openid_connect_provider" "github" {
 }
 
 locals {
-  oidc_sub = "repo:${var.github_repository}"
+  oidc_sub = var.github_oidc_subject
 }
 
 # Read-only: terraform plan on pull requests into main.
diff --git a/infra/terraform/bootstrap/variables.tf b/infra/terraform/bootstrap/variables.tf
index 919637c..875a842 100644
--- a/infra/terraform/bootstrap/variables.tf
+++ b/infra/terraform/bootstrap/variables.tf
@@ -3,10 +3,17 @@ variable "region" {
   default = "us-east-1"
 }
 
-variable "github_repository" {
-  description = "owner/name of the repository allowed to assume the CI roles"
+variable "github_oidc_subject" {
+  description = <<-EOT
+    The repository part of the GitHub OIDC `sub` claim the CI roles trust.
+    This repository uses GitHub's immutable subject claims, which embed the
+    owner and repository ids (owner@id/name@id), so a renamed or recreated
+    repository can't inherit the roles. Read the current value with
+    `gh api repos/<owner>/<repo>/actions/oidc/customization/sub`
+    (sub_claim_prefix).
+  EOT
   type        = string
-  default     = "CompositeCode/substratalapps.com"
+  default     = "repo:CompositeCode@38675098/substratalapps.com@1403762290"
 }
 
 variable "billing_email" {
diff --git a/infra/terraform/prod/main.tf b/infra/terraform/prod/main.tf
index 9264280..a6f38af 100644
--- a/infra/terraform/prod/main.tf
+++ b/infra/terraform/prod/main.tf
@@ -46,7 +46,7 @@ resource "aws_rds_cluster" "main" {
   cluster_identifier          = "${local.prefix}-db"
   engine                      = "aurora-postgresql"
   engine_mode                 = "provisioned"
-  engine_version              = "16.6"
+  engine_version              = "16.15"
   database_name               = local.db_name
   master_username             = "substratal"
   manage_master_user_password = true # Secrets Manager–managed; the Data API authenticates with it