Deployment action is selecting the wrong subscription

I have the following set up in Azure

* A 'global' subscription i.e. `GLOBAL-SUBSCRIPTION`
* My **Azure container registry** belongs to the `GLOBAL-SUBSCRIPTION`
* A 'per-environment' subscription e.g. a 'demo' subscription `DEMO-SUBCRIPTION`
* My hosted **Azure Function container app** belongs to the `DEMO-SUBSCRIPTION`

* I have defined the `Azure/functions-container-action@v1` in a workflow so that it will take the image from the above registry and run it on the function app, but it keeps failing with `Resource xxx doesn't exist.`

* In the debug logs, the call to `/subscriptions/` is using the `GLOBAL-SUBSCRIPTION` id above, not the app-specific one

* Double-checking, I regenerated the service principal and pointed to the resource group containing the container app:
But the action still tries to GET using the other subscription above.

There doesn't seem to be a way to make this distinction, unless I'm doing something wrong?
Is the current assumption that both registry and container app need to be co-located within the same subscription?