diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index b954f1a788..2ebc1f9df8 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -64,7 +64,7 @@ jobs:
           fetch-depth: 1
       - name: Run Claude Code
         if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1.0.187
         with:
           # The action's default trigger phrase is "@claude"; it reads the
           # triggering comment/review and acts on the current PR head.
diff --git a/scripts/github-action-pins.mjs b/scripts/github-action-pins.mjs
index cadcfdb894..2f9c7cebea 100644
--- a/scripts/github-action-pins.mjs
+++ b/scripts/github-action-pins.mjs
@@ -21,6 +21,11 @@ const reviewedActionPins = new Map([
       ["af0559ee4f514d1ef21826982bed13f7edc3c35e", "v1.0.178"],
       ["b76a0776ae74036e77cd11018083743453d7ad35", "v1.0.179"],
       ["be7b93b1907a4abad570368f3c74b6fe3807510b", "v1.0.183"],
+      // Reviewed 2026-08-10 for PR #1794: annotated tag v1.0.187 peels to this
+      // commit; release notes cover credential-pattern redaction in published
+      // run output, config-snapshot scoping to the working tree, and checkout
+      // auth cleanup when API commit signing is enabled.
+      ["1623c36729ac1cd5895198cded705a287de7db79", "v1.0.187"],
     ]),
   ],
   ["actions/cache", new Map([["55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6"]])],