diff --git a/config/clusters/iam.tf b/config/clusters/iam.tf
index 6f5b207bd5..5d2df2e601 100644
--- a/config/clusters/iam.tf
+++ b/config/clusters/iam.tf
@@ -266,7 +266,7 @@ module "test-infra_reader" {
   name    = "github_actions-test-infra-reader"
   create  = true
   subjects = [
-    "falcosecurity/test-infra:ref:*"
+    "falcosecurity/test-infra:pull_request"
   ]
   policies = {
     test-infra_read_access = "arn:aws:iam::aws:policy/ReadOnlyAccess"