diff --git a/.github/maintainers.json b/.github/maintainers.json
index 72e42c90..ada0c26c 100644
--- a/.github/maintainers.json
+++ b/.github/maintainers.json
@@ -7,11 +7,7 @@
     "carloshvp",
     "qubeena07",
     "zohebk8s",
-    "pforest",
-    "Qiang-Xu",
-    "rajnisht7",
-    "podcastinator",
-    "AaronRoeF"
+    "rajnisht7"
   ],
   "security_paths": [
     "src/cmcp_runtime/audit/",
diff --git a/.github/workflows/require-maintainer-approval.yml b/.github/workflows/require-maintainer-approval.yml
index cfe728fe..ccb774dc 100644
--- a/.github/workflows/require-maintainer-approval.yml
+++ b/.github/workflows/require-maintainer-approval.yml
@@ -33,17 +33,26 @@ jobs:
               pull_number: context.payload.pull_request.number,
             });
             // Read only reviewed base-branch data. Never execute or read policy from a PR head.
+            const readPolicy = async ref => (await github.rest.repos.getContent({
+              owner: context.repo.owner, repo: context.repo.repo,
+              path: '.github/maintainers.json', ref,
+            })).data;
             let file;
             try {
-              ({ data: file } = await github.rest.repos.getContent({
-                owner: context.repo.owner, repo: context.repo.repo,
-                path: '.github/maintainers.json', ref: pr.base.sha,
-              }));
+              file = await readPolicy(pr.base.sha);
             } catch (error) {
-              // One-commit bootstrap: the initial policy PR must be reviewable before its
-              // policy file exists on main. Missing policy on any later base fails closed.
-              if (error.status !== 404 || pr.base.sha !== "316ecf3176cb2d72c4f26060e1709016dd8f0b16") throw error;
-              file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"cmcp","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","carloshvp","qubeena07","zohebk8s","pforest","Qiang-Xu","rajnisht7","podcastinator","AaronRoeF"],"security_paths":["src/cmcp_runtime/audit/","src/cmcp_runtime/tee/","src/cmcp_runtime/policy/","src/cmcp_verify/"],"security_approvals":2})).toString('base64') };
+              if (error.status !== 404) throw error;
+              // A pull request opened before the policy file landed keeps that older base.sha,
+              // so read the policy at the tip of its base branch, which is reviewed data too.
+              // Qualified, so a tag with the branch's name cannot stand in for it.
+              try {
+                file = await readPolicy('refs/heads/' + pr.base.ref);
+              } catch (error) {
+                // One-commit bootstrap: the initial policy PR must be reviewable before its
+                // policy file exists on main. Missing policy on any later base fails closed.
+                if (error.status !== 404 || pr.base.sha !== "316ecf3176cb2d72c4f26060e1709016dd8f0b16") throw error;
+                file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"cmcp","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","carloshvp","qubeena07","zohebk8s","rajnisht7"],"security_paths":["src/cmcp_runtime/audit/","src/cmcp_runtime/tee/","src/cmcp_runtime/policy/","src/cmcp_verify/"],"security_approvals":2})).toString('base64') };
+              }
             }
             if (Array.isArray(file) || file.encoding !== 'base64') {
               throw new Error('Missing base-branch maintainer policy');
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index e1b3d5cd..1ecb4621 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -4,9 +4,7 @@
 
 | Name | GitHub | Affiliation | Role |
 |------|--------|-------------|------|
-| Imran Siddique | @imran-siddique | OPAQUE Systems | Project Lead |
-| Rishabh Poddar | @podcastinator | OPAQUE Systems | Maintainer |
-| Aaron Fulkerson | @AaronRoeF | OPAQUE Systems | Maintainer |
+| Imran Siddique | @imran-siddique | AgenTrust-io | Project Lead |
 
 The Project Lead has final decision authority on architecture, conformance
 requirements, and Maintainer appointments.
@@ -38,6 +36,11 @@ To be considered for maintainer status you must:
 
 Maintainers who are no longer active may move to emeritus status. Emeritus maintainers are listed here for recognition but do not hold merge rights or voting privileges.
 
+| Name | GitHub |
+|---|---|
+| Rishabh Poddar | @podcastinator |
+| Aaron Fulkerson | @AaronRoeF |
+
 ## Changes to This File
 
 Changes to MAINTAINERS.md must be approved by at least one existing maintainer.
@@ -52,3 +55,9 @@ Changes to MAINTAINERS.md must be approved by at least one existing maintainer.
 | Rajnish Tiwari | [@rajnisht7](https://github.com/rajnisht7) | [Project Lead announcement](https://github.com/orgs/agentrust-io/discussions/40) |
 
 These appointments cover this repository. CODEOWNERS determines which paths each reviewer can approve for protected merges.
+
+## Reviewers
+
+| Name | GitHub | Since |
+|---|---|---|
+| Noah Ingwers | [@noah-ing](https://github.com/noah-ing) | 2026-10-14, [accepted](https://github.com/agentrust-io/.github/issues/60#issuecomment-6179377337) |