diff --git a/.github/workflows/claude-adversarial-review.yml b/.github/workflows/claude-adversarial-review.yml
index 0875d93..d7a0cf2 100644
--- a/.github/workflows/claude-adversarial-review.yml
+++ b/.github/workflows/claude-adversarial-review.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Adversarial pass
         # Pinned to v1.0.112 (2026-05-04) — see claude-review.yml for context
         # (ci-workflows#37: v1.0.113/.114 regression breaks the setup step).
-        uses: anthropics/claude-code-action@08d635357c8fff73d997923c055449a03e92e0b6 # v1.0.112
+        uses: anthropics/claude-code-action@2cc1ac1331eac7a6a96d716dd204dd2888d0fcd2 # v1.0.112
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 40069e2..276d939 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -91,7 +91,7 @@ jobs:
         # Code native binary, causing every Claude Review across the fleet to
         # fail with "Claude Code native binary not found". See ci-workflows#37.
         # Restore to @v1 (or a fresh SHA) once upstream ships a fix.
-        uses: anthropics/claude-code-action@08d635357c8fff73d997923c055449a03e92e0b6 # v1.0.112
+        uses: anthropics/claude-code-action@2cc1ac1331eac7a6a96d716dd204dd2888d0fcd2 # v1.0.112
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Allow bot-initiated PRs (dependabot, renovate). Without this the
diff --git a/.github/workflows/verifier-on-high-risk.yml b/.github/workflows/verifier-on-high-risk.yml
index a4109ee..0294e8d 100644
--- a/.github/workflows/verifier-on-high-risk.yml
+++ b/.github/workflows/verifier-on-high-risk.yml
@@ -282,7 +282,7 @@ jobs:
         if: steps.classify.outputs.matched == 'yes'
         id: verifier
         continue-on-error: true # keep the workflow running so we can post the check-run with FAILURE conclusion
-        uses: anthropics/claude-code-action@08d635357c8fff73d997923c055449a03e92e0b6 # v1.0.112
+        uses: anthropics/claude-code-action@2cc1ac1331eac7a6a96d716dd204dd2888d0fcd2 # v1.0.112
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: ${{ steps.prompt.outputs.text }}