diff --git a/.github/workflows/rebuild-from-pins.yml b/.github/workflows/rebuild-from-pins.yml
index c264ae6..af747d1 100644
--- a/.github/workflows/rebuild-from-pins.yml
+++ b/.github/workflows/rebuild-from-pins.yml
@@ -124,7 +124,7 @@ jobs:
 
       # ---- AI triage: classify findings, decide push-vs-PR, propose minimal fixes ----
       - name: AI triage Trivy findings
-        uses: anthropics/claude-code-action@0b1b62002952733671bde978d429b50b51c51c85 # v1
+        uses: anthropics/claude-code-action@41ea7642c1436fa0ee57aae58347904b71a5af27 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           claude_args: >-
diff --git a/.github/workflows/track-upstream.yml b/.github/workflows/track-upstream.yml
index abbd1e4..43e3f9e 100644
--- a/.github/workflows/track-upstream.yml
+++ b/.github/workflows/track-upstream.yml
@@ -82,7 +82,7 @@ jobs:
       # ---- AI: adapt the Dockerfile + classify, only when a newer version exists ----
       - name: AI adapt Dockerfile + classify bump
         if: steps.gate.outputs.selected == 'true' && steps.resolve.outputs.is_newer == 'true'
-        uses: anthropics/claude-code-action@0b1b62002952733671bde978d429b50b51c51c85 # v1
+        uses: anthropics/claude-code-action@41ea7642c1436fa0ee57aae58347904b71a5af27 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           claude_args: >-