diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 97ad847..a28235b 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
diff --git a/.github/workflows/contextualize-skills.yml b/.github/workflows/contextualize-skills.yml
index 47a8159..349bd99 100644
--- a/.github/workflows/contextualize-skills.yml
+++ b/.github/workflows/contextualize-skills.yml
@@ -6,7 +6,15 @@ on:
 
 jobs:
   contextualize:
-    if: startsWith(github.head_ref, 'sync/skills-')
+    # Hardening (CodeQL actions/untrusted-checkout): this job checks out the PR
+    # head and runs Claude Code over it WITH secrets (ANTHROPIC_API_KEY),
+    # contents: write, and pull-requests: write, then pushes commits back.
+    # Restrict it to same-repo PRs so a fork PR can never reach this
+    # privileged, secret-bearing path. Combined with the sync/skills- branch
+    # filter, only the internal skills-sync automation can trigger it.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.head_ref, 'sync/skills-')
     runs-on: ubuntu-latest
 
     permissions:
@@ -32,7 +40,7 @@ jobs:
 
       - name: Run Claude Code
         if: steps.check_author.outputs.skip != 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ github.token }}