diff --git a/README.md b/README.md
index e7ca711..bfc8605 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ continuous integration tasks on AWS.
 module "aws_iam_role" {
   source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.1.0"
 
-  name            = local.name
+  name              = local.name
   policy_statements = jsonencode([
     {
       Action   = "acm:*"
@@ -24,6 +24,11 @@ module "aws_iam_role" {
 }
 ```
 
+## Assume role policy
+
+This role is designed to be used with AWS Identity Center and provisions a trust
+relationship to the root organization account.
+
 ## Policies
 
 The IAM role is granted the following permissions on the AWS account:
diff --git a/infrastructure/tofu/main.tf b/infrastructure/tofu/main.tf
index 37037f8..0d11105 100644
--- a/infrastructure/tofu/main.tf
+++ b/infrastructure/tofu/main.tf
@@ -8,12 +8,12 @@ module "aws_iam_ci_user" {
     aws.root  = aws.all["root"]
     aws.tests = aws.all["tests"]
   }
-  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.0"
+  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.1"
 
   name = local.name
   tests_policy_statements = jsonencode([{
     Action   = "iam:*"
     Effect   = "Allow"
-    Resource = "arn:aws:iam::*:role/tftest",
+    Resource = "arn:aws:iam::*:role/tftest-role",
   }])
 }
diff --git a/main.tftest.hcl b/main.tftest.hcl
index c21db0b..68f4c3b 100644
--- a/main.tftest.hcl
+++ b/main.tftest.hcl
@@ -11,5 +11,5 @@ run "main" {
 }
 
 variables {
-  name = "tftest"
+  name = "tftest-role"
 }