local part substitution sequence for rewrite backwards-directed addresses

I attempt to rewrite the from/reply-to address. in dependency of the recipient e.g. if I send to lists.example.org I want to rewrite my replay-to address from sender@company.com to sender@subsidary.org:

lists.example.org $E$R$U%subsidary.org@TCP-DAEMON

But if I use there $U it will set there the local part of the forward address, so if I try to send to support@lists.example.org it rewrites to support@subsidary.org instead of sender@subsidary.org.

Is there also a substitution sequence of the local part of the backward address?