diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index b0cfd3d394..5b5bd66ffe 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -69,16 +69,13 @@ jobs:
           # The action's default trigger phrase is "@claude"; it reads the
           # triggering comment/review and acts on the current PR head.
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          # DIAGNOSTIC (temporary): claude_args: --strict-mcp-config (added in
-          # #1359) had no observable effect on the crash — the run still fails
-          # in ~2s with $0 cost and zero turns, meaning no model call is ever
-          # made. This action runs the Agent SDK's query() in-process rather
-          # than spawning the `claude` CLI, so claude_args may not map to
-          # --strict-mcp-config at all. Setting `settings` directly targets
-          # the JSON key the action logs writing itself
-          # ("Updated settings with enableAllProjectMcpServers: true").
-          # show_full_output is on to capture the real error since the prior
-          # two failures were both silent. Revert both once root-caused.
-          claude_args: --strict-mcp-config
+          # Every @claude run had been failing with a 401
+          # ("OAuth access token is invalid") — a stale CLAUDE_CODE_OAUTH_TOKEN
+          # secret, root-caused via show_full_output after two earlier fix
+          # attempts (#1359, #1366) targeted the wrong thing (project MCP
+          # auto-load, which was never the actual cause). No workflow change
+          # fixes an invalid token; the secret itself needs regenerating with
+          # `claude setup-token`. This disables project MCP auto-load anyway,
+          # since a CI runner has no legitimate use for it (e.g. this repo's
+          # .mcp.json "railway" server, which has no session/auth in Actions).
           settings: '{"enableAllProjectMcpServers": false}'
-          show_full_output: true