diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index eb2eea8..211336c 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -51,12 +51,12 @@ jobs:
             echo "::notice::CLAUDE_CODE_OAUTH_TOKEN not set; skipping Claude review"
           fi
       - if: steps.token.outputs.present == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false
       - if: steps.token.outputs.present == 'true'
-        uses: anthropics/claude-code-action@97c53473391bff1901034d4b454b5bac7ab7a029 # v1
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           allowed_bots: "dependabot[bot]"
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 19e2877..b006754 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -37,10 +37,10 @@ jobs:
           if [ -n "$TOKEN" ]; then echo "present=true" >> "$GITHUB_OUTPUT"
           else echo "::notice::CLAUDE_CODE_OAUTH_TOKEN not set; skipping @claude"; fi
       - if: steps.token.outputs.present == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
       - if: steps.token.outputs.present == 'true'
-        uses: anthropics/claude-code-action@97c53473391bff1901034d4b454b5bac7ab7a029 # v1
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}