diff --git a/.github/workflows/post-merge-test-mutation.yml b/.github/workflows/post-merge-test-mutation.yml
index ca8056b90a2..fb7a7b4da97 100644
--- a/.github/workflows/post-merge-test-mutation.yml
+++ b/.github/workflows/post-merge-test-mutation.yml
@@ -311,7 +311,7 @@ jobs:
       - name: Run the mutation audit
         id: audit
         continue-on-error: true
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@4845bacbb38b3c4b15d948f035349786f678e068 # v1.0.267
         env:
           # Strips the OAuth token and other credentials from Bash, hook and
           # MCP subprocesses, the mutated tests included, and gives Bash its
diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml
index 9607f3125ce..e1c368911ee 100644
--- a/.github/workflows/pr-run-activity-write.yml
+++ b/.github/workflows/pr-run-activity-write.yml
@@ -1645,7 +1645,7 @@ jobs:
         if: >-
           steps.lane-token.outputs.token != '' && steps.config.outputs.kind == 'skill'
         continue-on-error: true
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@4845bacbb38b3c4b15d948f035349786f678e068 # v1.0.267
         env:
           # Strips the OAuth token and other credentials from Bash, hook and
           # MCP subprocesses and gives Bash its own PID namespace, so /proc