diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 0ff633830..c9cb02be7 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
 
       - name: Claude review (dependency updates)
-        uses: anthropics/claude-code-action@v1.0.226
+        uses: anthropics/claude-code-action@v1.0.230
 
         env:
           GH_TOKEN: ${{ github.token }}
@@ -97,7 +97,7 @@ jobs:
 
       - name: Claude review (general)
         if: github.event.action != 'synchronize'
-        uses: anthropics/claude-code-action@v1.0.226
+        uses: anthropics/claude-code-action@v1.0.230
         env:
           GH_TOKEN: ${{ github.token }}
         with:
@@ -154,7 +154,7 @@ jobs:
       # ── Follow-up on pushes: only the delta and existing findings ────────────
       - name: Follow-up Claude review (new commits only)
         if: github.event.action == 'synchronize'
-        uses: anthropics/claude-code-action@v1.0.226
+        uses: anthropics/claude-code-action@v1.0.230
         env:
           GH_TOKEN: ${{ github.token }}
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1ef31af7e..c51dd6c79 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -231,7 +231,7 @@ jobs:
 
       if: ${{ (success() || failure()) && inputs.upload_sarif && hashFiles('snyk-code.sarif') != '' }}
       continue-on-error: true
-      uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
       with:
         sarif_file: snyk-code.sarif
         category: snyk-code