diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5fa732..d25378b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,7 +134,7 @@ jobs:
           fetch-depth: 0
 
       - name: Scan for secrets
-        uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6
+        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.95.8
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha }}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 5f221fc..69f1bdf 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -66,7 +66,7 @@ jobs:
           echo "Claude token shape OK (length ${#TOKEN})."
 
       - name: Claude auto-review
-        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464 # v1
+        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1
         with:
           claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }}
           # Prompt sent automatically on every PR — no @claude mention needed
@@ -129,7 +129,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464 # v1
+        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1
         with:
           claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }}
           claude_args: |