diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7842535..34af292 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,2 +1,2 @@
 # Organization maintainers review all changes.
-* @imran-siddique @pforest @Qiang-Xu
+* @imran-siddique @rajnisht7 @carloshvp
diff --git a/.github/maintainers.json b/.github/maintainers.json
index a9cc8a6..254abf9 100644
--- a/.github/maintainers.json
+++ b/.github/maintainers.json
@@ -4,9 +4,8 @@
   "source": "agentrust-io/.github:maintainers/roster.json",
   "maintainers": [
     "imran-siddique",
-    "pforest",
-    "podcastinator",
-    "Qiang-Xu"
+    "rajnisht7",
+    "carloshvp"
   ],
   "security_paths": [],
   "security_approvals": 1
diff --git a/.github/workflows/require-maintainer-approval.yml b/.github/workflows/require-maintainer-approval.yml
index 22cfccf..65fecb5 100644
--- a/.github/workflows/require-maintainer-approval.yml
+++ b/.github/workflows/require-maintainer-approval.yml
@@ -29,17 +29,26 @@ jobs:
               pull_number: context.payload.pull_request.number,
             });
             // Read only reviewed base-branch data. Never execute or read policy from a PR head.
+            const readPolicy = async ref => (await github.rest.repos.getContent({
+              owner: context.repo.owner, repo: context.repo.repo,
+              path: '.github/maintainers.json', ref,
+            })).data;
             let file;
             try {
-              ({ data: file } = await github.rest.repos.getContent({
-                owner: context.repo.owner, repo: context.repo.repo,
-                path: '.github/maintainers.json', ref: pr.base.sha,
-              }));
+              file = await readPolicy(pr.base.sha);
             } catch (error) {
-              // One-commit bootstrap: the initial policy PR must be reviewable before its
-              // policy file exists on main. Missing policy on any later base fails closed.
-              if (error.status !== 404 || pr.base.sha !== "2405a48cb4acaa80fbcb7dccbc1b6430c75be786") throw error;
-              file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"agentrust-io.github.io","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","pforest","podcastinator","Qiang-Xu"],"security_paths":[],"security_approvals":1})).toString('base64') };
+              if (error.status !== 404) throw error;
+              // A pull request opened before the policy file landed keeps that older base.sha,
+              // so read the policy at the tip of its base branch, which is reviewed data too.
+              // Qualified, so a tag with the branch's name cannot stand in for it.
+              try {
+                file = await readPolicy('refs/heads/' + pr.base.ref);
+              } catch (error) {
+                // One-commit bootstrap: the initial policy PR must be reviewable before its
+                // policy file exists on main. Missing policy on any later base fails closed.
+                if (error.status !== 404 || pr.base.sha !== "2405a48cb4acaa80fbcb7dccbc1b6430c75be786") throw error;
+                file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"agentrust-io.github.io","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","rajnisht7","carloshvp"],"security_paths":[],"security_approvals":1})).toString('base64') };
+              }
             }
             if (Array.isArray(file) || file.encoding !== 'base64') {
               throw new Error('Missing base-branch maintainer policy');