diff --git a/broker/fragment/store_gcs.go b/broker/fragment/store_gcs.go
index 6c02c331..dcec760d 100644
--- a/broker/fragment/store_gcs.go
+++ b/broker/fragment/store_gcs.go
@@ -46,7 +46,7 @@ func (s *gcsBackend) SignGet(ep *url.URL, fragment pb.Fragment, d time.Duration)
 
 	if opts.GoogleAccessID == "" {
 		// workload identity approach
-		return client.Bucket(cfg.bucket).SignedURL(cfg.prefix, &opts)
+		return client.Bucket(cfg.bucket).SignedURL(cfg.rewritePath(cfg.prefix, fragment.ContentPath()), &opts)
 	} else {
 		return storage.SignedURL(cfg.bucket, cfg.rewritePath(cfg.prefix, fragment.ContentPath()), &opts)
 	}