diff --git a/.github/workflows/ai-claude-review.yml b/.github/workflows/ai-claude-review.yml
index 1a1d098..4fd3c8d 100644
--- a/.github/workflows/ai-claude-review.yml
+++ b/.github/workflows/ai-claude-review.yml
@@ -134,7 +134,7 @@ jobs:
             echo "::warning::GitHub API call failed; review-mode detection degraded (mode=$MODE)."
           fi
 
-      - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262
+      - uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           classify_inline_comments: 'false'
diff --git a/.github/workflows/ai-claude.yml b/.github/workflows/ai-claude.yml
index 70f1efa..177c5c0 100644
--- a/.github/workflows/ai-claude.yml
+++ b/.github/workflows/ai-claude.yml
@@ -57,6 +57,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262
+      - uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index e5d83e0..4ea5448 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -212,7 +212,7 @@ jobs:
       # prose comments — hence a YAML parser rather than a plain shell scan.
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
-          python-version: '3.15.1'
+          python-version: '3.15.2'
       - name: Install pyyaml
         run: python3 -m pip install --disable-pip-version-check pyyaml
       - name: Assert caller inputs reach shell bodies through env
diff --git a/.github/workflows/security-config.yml b/.github/workflows/security-config.yml
index dfe7391..79a8527 100644
--- a/.github/workflows/security-config.yml
+++ b/.github/workflows/security-config.yml
@@ -362,7 +362,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.15.1'
+          python-version: '3.15.2'
 
       - name: Install Ansible and ansible-lint
         env: