diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index a8323f82b51..260c12171e5 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -50,7 +50,7 @@ jobs:
     steps:
       - name: Check whether this PR event is allowed to reach Claude
         id: gate
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ github.token }}
           script: |
@@ -178,7 +178,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment with the refusal reason
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const reason = ${{ toJSON(needs.gate.outputs.reason) }};
diff --git a/.github/workflows/claude-write.yml b/.github/workflows/claude-write.yml
index d4d4c6ad03f..c5d27db8b93 100644
--- a/.github/workflows/claude-write.yml
+++ b/.github/workflows/claude-write.yml
@@ -52,7 +52,7 @@ jobs:
     steps:
       - name: Check whether this event is allowed to reach Claude
         id: gate
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ github.token }}
           script: |