diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 522db34..260794f 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -50,7 +50,7 @@ jobs:
       - run: uv sync --locked
 
       - name: Claude diagnoses (observe only — opens nothing)
-        uses: anthropics/claude-code-action@806af32823ef69c8ef357086c573a902af641307 # v1
+        uses: anthropics/claude-code-action@521136812280ae7ef256e06045655b9da02793f0 # v1
         with:
           # API-key auth (NOT subscription OAuth — ToS + CI reliability). The key
           # is a GitHub Actions secret and is never exposed.