diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 13138542..70745070 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@51db78a4b844e144f8d02425cb280435c04a3474 # v1.0.224
+        uses: anthropics/claude-code-action@a4f54ef2c58884867281bd8e2f8d63352ad019a9 # v1.0.229
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 169c849c..a05e72b5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
           # install` here failed on every scheduled run since at least
           # 2026-06-22, so JS/TS CodeQL analysis was silently not running.
           # CodeQL is cron-only, so no PR ever surfaced it.
-          version: "11.26.0"
+          version: "11.27.0"
 
       - name: Setup Node.js
         if: matrix.language == 'javascript-typescript'