diff --git a/.github/workflows/claude-assistant.yml b/.github/workflows/claude-assistant.yml
index ee986fc..5ac211f 100644
--- a/.github/workflows/claude-assistant.yml
+++ b/.github/workflows/claude-assistant.yml
@@ -276,7 +276,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@5ccc3a35a6367cdb8e6fbd0728287467540ecfe2 # v1.0.219
+        uses: anthropics/claude-code-action@7b0b255830a1fab6e602658672acad11c12d841d # v1.0.226
         with:
           # claude-code-action rejects non-User actors unless explicitly allowed.
           # The caller's author_association guard (OWNER/MEMBER/COLLABORATOR) is
diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml
index 7027e37..db6fd9a 100644
--- a/.github/workflows/claude-blocking-review.yml
+++ b/.github/workflows/claude-blocking-review.yml
@@ -596,7 +596,7 @@ jobs:
         if: steps.doc-check.outputs.skip != 'true' && steps.dependabot-check.outputs.skip != 'true'
         timeout-minutes: ${{ fromJSON(steps.estimate.outputs.timeout_minutes) }}
         continue-on-error: true  # infrastructure failure must not block merges
-        uses: anthropics/claude-code-action@5ccc3a35a6367cdb8e6fbd0728287467540ecfe2  # v1.0.219
+        uses: anthropics/claude-code-action@7b0b255830a1fab6e602658672acad11c12d841d  # v1.0.226
         with:
           # claude-code-action rejects non-User actors unless explicitly allowed.
           # Callers use this on pull_request events that fire for bot-opened PRs
@@ -667,7 +667,7 @@ jobs:
         if: steps.infra-probe.outputs.infra_down == 'true'
         timeout-minutes: ${{ fromJSON(steps.estimate.outputs.timeout_minutes) }}
         continue-on-error: true  # the terminal decision belongs to "Check review verdict"
-        uses: anthropics/claude-code-action@5ccc3a35a6367cdb8e6fbd0728287467540ecfe2  # v1.0.219
+        uses: anthropics/claude-code-action@7b0b255830a1fab6e602658672acad11c12d841d  # v1.0.226
         with:
           allowed_bots: "claude[bot],github-actions[bot],dependabot[bot]"
           claude_code_oauth_token: ${{ secrets.claude_oauth_token }}