diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index fe12088e82a..0a0402a0227 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -246,7 +246,7 @@ jobs:
 
       - name: Run Claude Code in review-only mode
         id: claude
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b  # v1.0.247
         with:
           # The `vortex-claude-ci` rule refuses any run off the default branch.
           anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_CI }}
diff --git a/.github/workflows/claude-write.yml b/.github/workflows/claude-write.yml
index f917fe1d4da..a0fd1900104 100644
--- a/.github/workflows/claude-write.yml
+++ b/.github/workflows/claude-write.yml
@@ -196,7 +196,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b  # v1.0.247
         with:
           # The environment puts `environment:claude-automation` in the OIDC subject,
           # which is all the `vortex-claude-write` rule matches. Unreachable elsewhere.
diff --git a/.github/workflows/fuzzer-fix-automation.yml b/.github/workflows/fuzzer-fix-automation.yml
index 44cf11c401b..f7b41344dcc 100644
--- a/.github/workflows/fuzzer-fix-automation.yml
+++ b/.github/workflows/fuzzer-fix-automation.yml
@@ -274,7 +274,7 @@ jobs:
           CRASH_FILE: ${{ steps.extract.outputs.crash_file }}
           CRASH_FILE_PATH: ${{ steps.download.outputs.crash_file_path }}
           ARTIFACT_URL: ${{ steps.extract.outputs.artifact_url }}
-        uses: anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790  # v1
+        uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b  # v1.0.247
         with:
           # Same `vortex-claude-ci` rule as the rest of the fuzz pipeline.
           anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_CI }}
diff --git a/.github/workflows/report-fuzz-crash.yml b/.github/workflows/report-fuzz-crash.yml
index 274e47c0ee1..4a8a5953d41 100644
--- a/.github/workflows/report-fuzz-crash.yml
+++ b/.github/workflows/report-fuzz-crash.yml
@@ -116,7 +116,7 @@ jobs:
           steps.dedup.outputs.duplicate != 'true' ||
           steps.dedup.outputs.confidence != 'exact'
         continue-on-error: true
-        uses: anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790  # v1
+        uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b  # v1.0.247
         with:
           # A called workflow sees the caller's OIDC subject, so `vortex-claude-ci`
           # matches here too and no secret needs passing down.