diff --git a/.github/maintainers.json b/.github/maintainers.json
index 392733c..97d3c53 100644
--- a/.github/maintainers.json
+++ b/.github/maintainers.json
@@ -4,12 +4,8 @@
   "source": "agentrust-io/.github:maintainers/roster.json",
   "maintainers": [
     "imran-siddique",
-    "pforest",
-    "podcastinator",
     "carloshvp",
-    "Qiang-Xu",
-    "zohebk8s",
-    "AaronRoeF"
+    "zohebk8s"
   ],
   "security_paths": [
     "src/ca2a_runtime/delegation/",
diff --git a/.github/workflows/require-maintainer-approval.yml b/.github/workflows/require-maintainer-approval.yml
index 2dc3e1c..bf7e675 100644
--- a/.github/workflows/require-maintainer-approval.yml
+++ b/.github/workflows/require-maintainer-approval.yml
@@ -33,17 +33,26 @@ jobs:
               pull_number: context.payload.pull_request.number,
             });
             // Read only reviewed base-branch data. Never execute or read policy from a PR head.
+            const readPolicy = async ref => (await github.rest.repos.getContent({
+              owner: context.repo.owner, repo: context.repo.repo,
+              path: '.github/maintainers.json', ref,
+            })).data;
             let file;
             try {
-              ({ data: file } = await github.rest.repos.getContent({
-                owner: context.repo.owner, repo: context.repo.repo,
-                path: '.github/maintainers.json', ref: pr.base.sha,
-              }));
+              file = await readPolicy(pr.base.sha);
             } catch (error) {
-              // One-commit bootstrap: the initial policy PR must be reviewable before its
-              // policy file exists on main. Missing policy on any later base fails closed.
-              if (error.status !== 404 || pr.base.sha !== "b60768502822f93159ad5f4f254110676d32703e") throw error;
-              file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"ca2a","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","pforest","podcastinator","carloshvp","Qiang-Xu","zohebk8s","AaronRoeF"],"security_paths":["src/ca2a_runtime/delegation/","src/ca2a_runtime/channel/","src/ca2a_runtime/tee/","src/ca2a_verify/"],"security_approvals":2})).toString('base64') };
+              if (error.status !== 404) throw error;
+              // A pull request opened before the policy file landed keeps that older base.sha,
+              // so read the policy at the tip of its base branch, which is reviewed data too.
+              // Qualified, so a tag with the branch's name cannot stand in for it.
+              try {
+                file = await readPolicy('refs/heads/' + pr.base.ref);
+              } catch (error) {
+                // One-commit bootstrap: the initial policy PR must be reviewable before its
+                // policy file exists on main. Missing policy on any later base fails closed.
+                if (error.status !== 404 || pr.base.sha !== "b60768502822f93159ad5f4f254110676d32703e") throw error;
+                file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"ca2a","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","carloshvp","zohebk8s"],"security_paths":["src/ca2a_runtime/delegation/","src/ca2a_runtime/channel/","src/ca2a_runtime/tee/","src/ca2a_verify/"],"security_approvals":2})).toString('base64') };
+              }
             }
             if (Array.isArray(file) || file.encoding !== 'base64') {
               throw new Error('Missing base-branch maintainer policy');
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 0a0ef28..539652d 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -4,9 +4,7 @@
 
 | Name | GitHub | Affiliation | Role |
 |------|--------|-------------|------|
-| Imran Siddique | @imran-siddique | OPAQUE Systems | Project Lead |
-| Rishabh Poddar | @podcastinator | OPAQUE Systems | Maintainer |
-| Aaron Fulkerson | @AaronRoeF | OPAQUE Systems | Maintainer |
+| Imran Siddique | @imran-siddique | AgenTrust-io | Project Lead |
 
 The Project Lead has final decision authority on architecture, conformance
 requirements, and Maintainer appointments.
@@ -38,6 +36,11 @@ To be considered for maintainer status you must:
 
 Maintainers who are no longer active may move to emeritus status. Emeritus maintainers are listed here for recognition but do not hold merge rights or voting privileges.
 
+| Name | GitHub |
+|---|---|
+| Rishabh Poddar | @podcastinator |
+| Aaron Fulkerson | @AaronRoeF |
+
 ## Changes to This File
 
 Changes to MAINTAINERS.md must be approved by at least one existing maintainer.
@@ -50,3 +53,9 @@ Changes to MAINTAINERS.md must be approved by at least one existing maintainer.
 | Zoheb | [@zohebk8s](https://github.com/zohebk8s) | [Project Lead announcement](https://github.com/orgs/agentrust-io/discussions/31) |
 
 These appointments cover this repository. CODEOWNERS determines which paths each reviewer can approve for protected merges.
+
+## Reviewers
+
+| Name | GitHub | Since |
+|---|---|---|
+| Noah Ingwers | [@noah-ing](https://github.com/noah-ing) | 2026-10-14, [accepted](https://github.com/agentrust-io/.github/issues/60#issuecomment-6179377337) |