diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 974b5bb..a4b5035 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-deploy-miti99bot
+          role-to-assume: arn:aws:iam::225603493174:role/github-deploy-miti99bot
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Build Lambda binary
diff --git a/aws/README.md b/aws/README.md
index ee2d0e4..2f572c3 100644
--- a/aws/README.md
+++ b/aws/README.md
@@ -56,7 +56,7 @@ aws iam create-open-id-connect-provider \
 
 ## 4. Deploy IAM role for GitHub Actions
 
-Edit `aws/iam-github-oidc-trust.json` to set your AWS account ID and GitHub repo, then:
+Edit `aws/iam-github-oidc-trust.json` if you are changing the AWS account or GitHub repo. This repo is already prefilled for account `225603493174` and `tiennm99/miti99bot`. If you change accounts, update `.github/workflows/deploy.yml` to match the same role ARN, then:
 
 ```sh
 aws iam create-role \
@@ -89,10 +89,9 @@ In GitHub repo settings → Secrets and variables → Actions:
 
 | Secret | Value |
 |---|---|
-| `AWS_ACCOUNT_ID` | 12-digit AWS account ID |
 | `ALERT_EMAIL` (optional) | Email for the $1 budget alert |
 
-`AWS_ACCOUNT_ID` is not a credential — it's hidden only to keep the ARN out of the workflow file.
+The deploy workflow now uses the repo's fixed AWS account ID directly for the OIDC role ARN, so `AWS_ACCOUNT_ID` no longer needs to be stored in GitHub.
 
 ## 6. First deploy (manual)
 
diff --git a/docs/deploy-aws-free-tier-guide.md b/docs/deploy-aws-free-tier-guide.md
index badb711..36a4e1e 100644
--- a/docs/deploy-aws-free-tier-guide.md
+++ b/docs/deploy-aws-free-tier-guide.md
@@ -187,12 +187,14 @@ aws iam get-open-id-connect-provider --profile admin \
        --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
 ```
 
-Edit `aws/iam-github-oidc-trust.json` — fill in your 12-digit AWS account ID and `tiennm99/miti99bot` (or your fork):
+Edit `aws/iam-github-oidc-trust.json` if you're deploying from a different AWS account or repo fork. This repo is already prefilled for account `225603493174` and `tiennm99/miti99bot`:
 
 ```sh
-sed -i "s|225603493174|$ACCT|" aws/iam-github-oidc-trust.json   # only if the placeholder differs
+sed -i "s|225603493174|$ACCT|" aws/iam-github-oidc-trust.json   # only if you are changing accounts
 ```
 
+If you change accounts, update `.github/workflows/deploy.yml` to match the same role ARN.
+
 Create the role (idempotent — `update-assume-role-policy` if it already exists):
 
 ```sh
@@ -283,7 +285,6 @@ In GitHub → repo Settings → Secrets and variables → Actions:
 
 | Secret | Value |
 |---|---|
-| `AWS_ACCOUNT_ID` | 12-digit AWS account ID |
 | `ALERT_EMAIL` (optional) | Email for the $1 budget alert |
 
 After this, every push to `main` triggers `.github/workflows/deploy.yml`:
@@ -292,7 +293,7 @@ After this, every push to `main` triggers `.github/workflows/deploy.yml`:
 3. `sam deploy --template-file template.yaml`
 4. Smoke `curl <function-url>/`
 
-No long-lived keys live in GitHub.
+No long-lived keys live in GitHub. The deploy workflow now uses the repo's fixed AWS account ID directly for the OIDC role ARN, so `AWS_ACCOUNT_ID` no longer needs to be stored in GitHub.
 
 ---