diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index d3fe8ddb24..7bf6a68fea 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -150,7 +150,7 @@ jobs:
 
     - name: Upload coverage to Codecov
       if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]'
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: ./coverage.xml
@@ -225,7 +225,7 @@ jobs:
 
     - name: Upload frontend coverage to Codecov
       if: steps.check.outputs.should_test == 'true'
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: ./app/coverage/coverage-final.json
diff --git a/.github/workflows/daily-regen.yml b/.github/workflows/daily-regen.yml
index bd81baad66..2e3a626bac 100644
--- a/.github/workflows/daily-regen.yml
+++ b/.github/workflows/daily-regen.yml
@@ -227,7 +227,7 @@ jobs:
         # block the main regeneration pipeline. Skip cleanly and continue.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model haiku'
@@ -243,7 +243,7 @@ jobs:
         # rather than aborting the dispatch.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model haiku'
diff --git a/.github/workflows/impl-generate.yml b/.github/workflows/impl-generate.yml
index 93dcad275a..165627d281 100644
--- a/.github/workflows/impl-generate.yml
+++ b/.github/workflows/impl-generate.yml
@@ -401,7 +401,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }}"
@@ -421,7 +421,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }}"
diff --git a/.github/workflows/impl-repair.yml b/.github/workflows/impl-repair.yml
index 8acb7ca8bb..64c9954eec 100644
--- a/.github/workflows/impl-repair.yml
+++ b/.github/workflows/impl-repair.yml
@@ -144,7 +144,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ inputs.model || 'sonnet' }}"
@@ -164,7 +164,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ inputs.model || 'sonnet' }}"
diff --git a/.github/workflows/impl-review.yml b/.github/workflows/impl-review.yml
index 1cb39d6a0b..7ae7179d7c 100644
--- a/.github/workflows/impl-review.yml
+++ b/.github/workflows/impl-review.yml
@@ -191,7 +191,7 @@ jobs:
         id: review
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         env:
           LIBRARY: ${{ steps.pr.outputs.library }}
           SPEC_ID: ${{ steps.pr.outputs.specification_id }}
diff --git a/.github/workflows/report-validate.yml b/.github/workflows/report-validate.yml
index 31a19363d0..238fe549b0 100644
--- a/.github/workflows/report-validate.yml
+++ b/.github/workflows/report-validate.yml
@@ -56,7 +56,7 @@ jobs:
         id: validate
         continue-on-error: true
         timeout-minutes: 10
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/spec-create.yml b/.github/workflows/spec-create.yml
index 1b0629e841..6b3758644e 100644
--- a/.github/workflows/spec-create.yml
+++ b/.github/workflows/spec-create.yml
@@ -69,7 +69,7 @@ jobs:
         id: process
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
@@ -178,7 +178,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true' && steps.process.outcome == 'failure'
         id: process_retry
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/util-claude.yml b/.github/workflows/util-claude.yml
index e40db12df8..ec015a8233 100644
--- a/.github/workflows/util-claude.yml
+++ b/.github/workflows/util-claude.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Run Claude Code
         id: claude
         continue-on-error: true
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus"
@@ -53,7 +53,7 @@ jobs:
       - name: Retry Claude (on failure)
         if: steps.claude.outcome == 'failure'
         id: claude_retry
-        uses: anthropics/claude-code-action@dde2242db6af13460b916652159b6ba19a598f30  # v1
+        uses: anthropics/claude-code-action@24492741e0ccfdef4c1d19da8e11e0f373d07494  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus"