diff --git a/infra/identity/google.tf b/infra/identity/google.tf
index 7df00e8..8f20ea0 100644
--- a/infra/identity/google.tf
+++ b/infra/identity/google.tf
@@ -19,7 +19,7 @@ locals {
 
   google_runner_wif_group_members = var.google_wif_runner_group != "" ? (
     toset([
-      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/attribute.burrow_groups/${var.google_wif_runner_group}"
+      "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/group/${var.google_wif_runner_group}"
     ])
     ) : (
     toset([])
@@ -142,7 +142,6 @@ resource "google_iam_workload_identity_pool_provider" "forgejo_runners" {
     "attribute.burrow_subject"   = "assertion.sub"
     "attribute.burrow_username"  = "assertion.preferred_username"
     "attribute.burrow_email"     = "assertion.email"
-    "attribute.burrow_groups"    = "assertion.groups"
     "attribute.burrow_client_id" = "assertion.azp"
   }
 
diff --git a/infra/identity/variables.tf b/infra/identity/variables.tf
index c88b52a..53889b6 100644
--- a/infra/identity/variables.tf
+++ b/infra/identity/variables.tf
@@ -177,7 +177,7 @@ variable "google_wif_allowed_audiences" {
 }
 
 variable "google_wif_runner_group" {
-  description = "Mapped Authentik group allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
+  description = "Google groups principal allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
   type        = string
   default     = ""
 }