diff --git a/.github/workflows/claude-e2e-verify.yml b/.github/workflows/claude-e2e-verify.yml
index 10385078..2c729f99 100644
--- a/.github/workflows/claude-e2e-verify.yml
+++ b/.github/workflows/claude-e2e-verify.yml
@@ -538,7 +538,7 @@ jobs:
         # showing as a red check — this lane is advisory.
         continue-on-error: true
         timeout-minutes: ${{ inputs.timeout-minutes }}
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: ${{ inputs.claude-args }}
@@ -745,7 +745,7 @@ jobs:
         # ceiling.
         continue-on-error: true
         timeout-minutes: ${{ inputs.timeout-minutes }}
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: ${{ inputs.claude-args }}
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index a4d18fd4..6159178a 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -482,7 +482,7 @@ jobs:
         # retry below.
         continue-on-error: true
         timeout-minutes: 11
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           track_progress: ${{ inputs.track-progress }}
@@ -724,7 +724,7 @@ jobs:
         # budget.
         continue-on-error: true
         timeout-minutes: 11
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           track_progress: ${{ inputs.track-progress }}
diff --git a/.github/workflows/claude-security-review.yml b/.github/workflows/claude-security-review.yml
index 2272acaa..6a3a4f2f 100644
--- a/.github/workflows/claude-security-review.yml
+++ b/.github/workflows/claude-security-review.yml
@@ -688,7 +688,7 @@ jobs:
         # leaves room for the retry (see the retry formula there).
         continue-on-error: true
         timeout-minutes: 18
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # A clean security pass otherwise produces no visible output (upstream
@@ -946,7 +946,7 @@ jobs:
         # and the same step timeout keeps the retry inside the job budget.
         continue-on-error: true
         timeout-minutes: 18
-        uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
+        uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # A clean security pass otherwise produces no visible output (upstream