@@ -61,20 +61,21 @@ jobs:
           persist-credentials: false
           filter: blob:none
           sparse-checkout: tools/aurora-ci
-      # From the target branch, never the pull request: a pull request must
-      # not vouch for its own author. Without the list (the branch does not
-      # have one yet, or the API fails) no author is trusted.
+      # From the target branch's tip, never the pull request: a pull request
+      # must not vouch for its own author. Not pull_request.base.sha, which
+      # stays at the base the pull request was opened against. Without the
+      # list (the API fails) no author is trusted.
       - name: Read the vouch list from the target branch
         if: github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
           if ! gh api -H "Accept: application/vnd.github.raw+json" \
-              "repos/$GITHUB_REPOSITORY/contents/.github/VOUCHED.td?ref=$BASE_SHA" \
+              "repos/$GITHUB_REPOSITORY/contents/.github/VOUCHED.td?ref=refs/heads/$BASE_REF" \
               > "$RUNNER_TEMP/VOUCHED.td"; then
             : > "$RUNNER_TEMP/VOUCHED.td"
-            echo "::warning title=Vouch list::no .github/VOUCHED.td at $BASE_SHA; no author is trusted"
+            echo "::warning title=Vouch list::no .github/VOUCHED.td on $BASE_REF; no author is trusted"
           fi
       - name: Plan the run
         id: plan