diff --git a/.github/actions/setup-r/action.yml b/.github/actions/setup-r/action.yml
index 7b04099fcee..960a84d31b4 100644
--- a/.github/actions/setup-r/action.yml
+++ b/.github/actions/setup-r/action.yml
@@ -18,7 +18,7 @@ runs:
       # r-lib/actions ships every sub-action from a single repo and tags them
       # together; pinned to the v2 tag's commit SHA like every workflow-level
       # action in this repo (Dependabot keeps the pin fresh).
-      uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6  # v2
+      uses: r-lib/actions/setup-r@465b7d8e732ca3921382b1674c59bada9cbf3399  # v2
       with:
         r-version: ${{ inputs.r-version }}
         use-public-rspm: true
diff --git a/.github/workflows/daily-regen.yml b/.github/workflows/daily-regen.yml
index 3dde67712ea..da0066d74df 100644
--- a/.github/workflows/daily-regen.yml
+++ b/.github/workflows/daily-regen.yml
@@ -237,7 +237,7 @@ jobs:
         # block the main regeneration pipeline. Skip cleanly and continue.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model haiku --settings ${{ github.workspace }}/.claude/settings.json'
@@ -253,7 +253,7 @@ jobs:
         # rather than aborting the dispatch.
         continue-on-error: true
         timeout-minutes: 15
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: '--model haiku --settings ${{ github.workspace }}/.claude/settings.json'
diff --git a/.github/workflows/impl-generate.yml b/.github/workflows/impl-generate.yml
index 06c08fa8110..4cfd29eae83 100644
--- a/.github/workflows/impl-generate.yml
+++ b/.github/workflows/impl-generate.yml
@@ -422,7 +422,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
@@ -442,7 +442,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ steps.inputs.outputs.model }} --settings ${{ github.workspace }}/.claude/settings.json"
diff --git a/.github/workflows/impl-repair.yml b/.github/workflows/impl-repair.yml
index 3cf44b52127..516286e8a79 100644
--- a/.github/workflows/impl-repair.yml
+++ b/.github/workflows/impl-repair.yml
@@ -160,7 +160,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ inputs.model || 'sonnet' }} --settings ${{ github.workspace }}/.claude/settings.json"
@@ -180,7 +180,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model ${{ inputs.model || 'sonnet' }} --settings ${{ github.workspace }}/.claude/settings.json"
diff --git a/.github/workflows/impl-review.yml b/.github/workflows/impl-review.yml
index 708f922abd3..0bdc160b1f8 100644
--- a/.github/workflows/impl-review.yml
+++ b/.github/workflows/impl-review.yml
@@ -318,7 +318,7 @@ jobs:
         id: review
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         env:
           LIBRARY: ${{ steps.pr.outputs.library }}
           SPEC_ID: ${{ steps.pr.outputs.specification_id }}
diff --git a/.github/workflows/report-validate.yml b/.github/workflows/report-validate.yml
index 9f6ed42d041..b86b5a8717b 100644
--- a/.github/workflows/report-validate.yml
+++ b/.github/workflows/report-validate.yml
@@ -58,7 +58,7 @@ jobs:
         id: validate
         continue-on-error: true
         timeout-minutes: 10
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/spec-create.yml b/.github/workflows/spec-create.yml
index 3069fb9ffb4..b95c5dd5286 100644
--- a/.github/workflows/spec-create.yml
+++ b/.github/workflows/spec-create.yml
@@ -69,7 +69,7 @@ jobs:
         id: process
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
@@ -178,7 +178,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true' && steps.process.outcome == 'failure'
         id: process_retry
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         env:
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
diff --git a/.github/workflows/util-claude.yml b/.github/workflows/util-claude.yml
index d145614ff03..c169254b87d 100644
--- a/.github/workflows/util-claude.yml
+++ b/.github/workflows/util-claude.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Run Claude Code
         id: claude
         continue-on-error: true
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"
@@ -53,7 +53,7 @@ jobs:
       - name: Retry Claude (on failure)
         if: steps.claude.outcome == 'failure'
         id: claude_retry
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a  # v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model opus --settings ${{ github.workspace }}/.claude/settings.json"