diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 3f2797e8..e91ba879 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -276,7 +276,7 @@ jobs:
         # Whenever it moves, re-read the action's release notes for changes to
         # the scrub, MCP wiring, or the `execution_file` contract that the
         # summary step below parses.
-        uses: anthropics/claude-code-action@9cdae7f0d995e3ba7c33f226087fdf82a59cd520 # v1 (Claude Code 2.1.270)
+        uses: anthropics/claude-code-action@4036a180cf690f49529f5d8c79c998855287f590 # v1 (Claude Code 2.1.270)
         with:
           # Use the workflow's GITHUB_TOKEN for GitHub API calls instead of the
           # default OIDC -> Claude GitHub App token exchange. That exchange