diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02329a7..0c54a9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     strategy:
       matrix:
         # The oldest and the newest Python that the scripts support.
-        python: ["3.10", "3.15"]
+        python: ["3.10.22", "3.15.1"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/org.yml b/.github/workflows/org.yml
index 57a7eba..38b9a6e 100644
--- a/.github/workflows/org.yml
+++ b/.github/workflows/org.yml
@@ -222,7 +222,7 @@ jobs:
           # The credential helper supplies fresh tokens.
           persist-credentials: false
 
-      - uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+      - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }}
           SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }}
diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml
index 101ec35..a502e92 100644
--- a/.github/workflows/run.yml
+++ b/.github/workflows/run.yml
@@ -158,7 +158,7 @@ jobs:
           git config --global user.name 'github-actions[bot]'
           git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
 
-      - uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1.0.250
+      - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         env:
           SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }}
           SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }}