diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml
index d24f848f..bc488d34 100644
--- a/.github/workflows/security-audit.yaml
+++ b/.github/workflows/security-audit.yaml
@@ -77,7 +77,7 @@ jobs:
           exit 1
 
       - name: Audit against the security specs
-        uses: anthropics/claude-code-action@9cdae7f0d995e3ba7c33f226087fdf82a59cd520 # v1
+        uses: anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd # v1
         env:
           # `claude-code-action` resets `GH_TOKEN` to its own internal
           # workflow token, so setting `GH_TOKEN` at this scope is