diff --git a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
index 5af9c32..35aa1f7 100644
--- a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
+++ b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
@@ -126,8 +126,8 @@ Optionally record a receipt with `scripts/openbao-platform-admin-check.sh --rece
 Rollback (if step 4 fails, from the still-open session):
 
 ```bash
-git show HEAD:openbao/auth/netkingdom-platform-admin-role.json > /tmp/pa-role.new   # post-change; for the old body use the commit before this workplan:
-git show "$(git log --format=%h -n1 --diff-filter=M -- openbao/auth/netkingdom-platform-admin-role.json)^:openbao/auth/netkingdom-platform-admin-role.json" > ~/.local/state/railiance/pa-role.prev.json
+# previous declaration = the file as of the parent of this workplan's commit
+git show 2126457^:openbao/auth/netkingdom-platform-admin-role.json > ~/.local/state/railiance/pa-role.prev.json
 grep -c assurance ~/.local/state/railiance/pa-role.prev.json   # expect 0
 bao write auth/netkingdom/role/platform-admin @$HOME/.local/state/railiance/pa-role.prev.json
 ```