diff --git a/sourcepolicy/engine.go b/sourcepolicy/engine.go
index 4a6100b83..ccf21d4a0 100644
--- a/sourcepolicy/engine.go
+++ b/sourcepolicy/engine.go
@@ -130,7 +130,7 @@ func (e *Engine) evaluatePolicy(ctx context.Context, pol *spb.Policy, srcOp *pb.
 	var deny bool
 	for _, rule := range pol.Rules {
 		selector := e.selectorCache(rule.Selector)
-		matched, err := match(selector, ident, srcOp.Attrs)
+		matched, err := match(selector, ident, rule.Selector.Constraints, srcOp.Attrs)
 		if err != nil {
 			return false, errors.Wrap(err, "error matching source policy")
 		}
diff --git a/sourcepolicy/matcher.go b/sourcepolicy/matcher.go
index d3fd2e456..ff1f8c657 100644
--- a/sourcepolicy/matcher.go
+++ b/sourcepolicy/matcher.go
@@ -7,8 +7,8 @@ import (
 	"github.com/pkg/errors"
 )
 
-func match(src *selectorCache, ref string, attrs map[string]string) (bool, error) {
-	for _, c := range src.Constraints {
+func match(src *selectorCache, ref string, constraints []*spb.AttrConstraint, attrs map[string]string) (bool, error) {
+	for _, c := range constraints {
 		if c == nil {
 			return false, errors.Errorf("invalid nil constraint for %v", src)
 		}
diff --git a/sourcepolicy/matcher_test.go b/sourcepolicy/matcher_test.go
index 7df31cf7c..c9e8d2390 100644
--- a/sourcepolicy/matcher_test.go
+++ b/sourcepolicy/matcher_test.go
@@ -319,7 +319,7 @@ func TestMatch(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			matches, err := match(&selectorCache{Selector: tc.src}, tc.ref, tc.attrs)
+			matches, err := match(&selectorCache{Selector: tc.src}, tc.ref, tc.src.Constraints, tc.attrs)
 			if !tc.xErr {
 				require.NoError(t, err)
 			} else {