--- a/taskcluster/actions/registry.py
+++ b/taskcluster/actions/registry.py
@@ -1,11 +1,12 @@
 import json
 import os
 import inspect
+import re
 from types import FunctionType
 from collections import namedtuple
 from taskgraph.util.docker import docker_image
 from taskgraph.parameters import Parameters
 
 
 GECKO = os.path.realpath(os.path.join(__file__, '..', '..', '..'))
 
@@ -154,32 +155,39 @@ def register_callback_action(title, symb
         assert not mem['registered'], 'register_callback_action must be used as decorator'
         assert cb.__name__ not in callbacks, 'callback name {} is not unique'.format(cb.__name__)
         source_path = os.path.relpath(inspect.stack()[1][1], GECKO)
 
         @register_task_action(title, description, order, context, schema)
         def build_callback_action_task(parameters):
             if not available(parameters):
                 return None
+
+            match = re.match(r'https://(hg.mozilla.org)/(.*?)/?$', parameters['head_repository'])
+            if not match:
+                raise Exception('Unrecognized head_repository')
+            repo_scope = 'assume:repo:{}/{}:*'.format(
+                match.group(1), match.group(2))
+
             return {
                 'created': {'$fromNow': ''},
                 'deadline': {'$fromNow': '12 hours'},
                 'expires': {'$fromNow': '14 days'},
                 'metadata': {
                     'owner': 'mozilla-taskcluster-maintenance@mozilla.com',
                     'source': '{}raw-file/{}/{}'.format(
                         parameters['head_repository'], parameters['head_rev'], source_path,
                     ),
                     'name': 'Action: {}'.format(title),
                     'description': 'Task executing callback for action.\n\n---\n' + description,
                 },
                 'workerType': 'gecko-decision',
                 'provisionerId': 'aws-provisioner-v1',
                 'scopes': [
-                    'assume:repo:hg.mozilla.org/projects/{}:*'.format(parameters['project']),
+                    repo_scope,
                 ],
                 'tags': {
                     'createdForUser': parameters['owner'],
                     'kind': 'action-callback',
                 },
                 'routes': [
                     'tc-treeherder.v2.{}.{}.{}'.format(
                         parameters['project'], parameters['head_rev'], parameters['pushlog_id']),