diff --git a/.github/workflows/claude-assistant.yml b/.github/workflows/claude-assistant.yml
index 20499bc..d91160b 100644
--- a/.github/workflows/claude-assistant.yml
+++ b/.github/workflows/claude-assistant.yml
@@ -47,6 +47,12 @@ jobs:
         id: claude
         uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1
         with:
+          # claude-code-action rejects non-User actors unless explicitly allowed.
+          # The caller's author_association guard (OWNER/MEMBER/COLLABORATOR) is
+          # the primary authorization — this list only names the bots that are
+          # legitimate secondary triggers (e.g., claude[bot] updating a thread,
+          # github-actions[bot] re-running after a synchronize push).
+          allowed_bots: "claude[bot],github-actions[bot]"
           claude_code_oauth_token: ${{ secrets.claude_oauth_token }}
 
           # Required for Claude to read CI results on PRs
diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml
index 1866d4c..562617b 100644
--- a/.github/workflows/claude-blocking-review.yml
+++ b/.github/workflows/claude-blocking-review.yml
@@ -374,6 +374,12 @@ jobs:
         continue-on-error: true  # infrastructure failure must not block merges
         uses: anthropics/claude-code-action@v1
         with:
+          # claude-code-action rejects non-User actors unless explicitly allowed.
+          # Callers use this on pull_request events that fire for bot-opened PRs
+          # (dependabot) and synchronize events triggered by bot pushes (claude,
+          # github-actions). Named list only — see docs/security.md in the action
+          # repo for why `*` is discouraged.
+          allowed_bots: "claude[bot],github-actions[bot],dependabot[bot]"
           claude_code_oauth_token: ${{ secrets.claude_oauth_token }}
           prompt: |
             REPO: ${{ github.repository }}