diff --git a/extension/privilege_zone_rules/t0-all-repo-admin-role.json b/extension/privilege_zone_rules/t0-all-repo-admin-role.json
index 4b61324..2ae4299 100644
--- a/extension/privilege_zone_rules/t0-all-repo-admin-role.json
+++ b/extension/privilege_zone_rules/t0-all-repo-admin-role.json
@@ -1,7 +1,7 @@
 {
   "name": "GitHub: Tier Zero All-Repo Admin Role",
   "description": "The synthetic all_repo_admin role grants admin access to every repository in the organization. This role is inherited by the owners role via GH_HasBaseRole and cascades admin permissions including branch protection editing, secret access, and deploy key management to all repositories.",
-  "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'ALL_REPO_ADMIN'\nRETURN n",
+  "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'all_repo_admin'\nRETURN n",
   "enabled": true,
   "zone": "Tier Zero",
   "allow_disable": true
diff --git a/extension/privilege_zone_rules/t0-pats-all-repos.json b/extension/privilege_zone_rules/t0-pats-all-repos.json
index 4eadaed..25ab118 100644
--- a/extension/privilege_zone_rules/t0-pats-all-repos.json
+++ b/extension/privilege_zone_rules/t0-pats-all-repos.json
@@ -1,7 +1,7 @@
 {
   "name": "GitHub: Tier Zero PATs (All Repositories)",
   "description": "Fine-grained personal access tokens scoped to all repositories in the organization that have repository-control write permissions. A single compromised token may grant code, workflow, Actions, or administrative control across every repository. PATs with only read or lower-impact write permissions are excluded.",
-  "cypher": "MATCH (n:GH_PersonalAccessToken)-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
+  "cypher": "MATCH (n:GH_PersonalAccessToken {token_expired:false})-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
   "enabled": true,
   "zone": "Tier Zero",
   "allow_disable": true