diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 377c68b24..5f5c5bb6d 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -71,7 +71,7 @@ jobs:
           fetch-depth: 1
       - name: Run Claude Code
         if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
-        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
+        uses: anthropics/claude-code-action@ef8bb1e43bf303cff727a1dd0b8837029fe982a2 # v1.0.215
         with:
           # The action's default trigger phrase is "@claude"; it reads the
           # triggering comment/review and acts on the current PR head.
diff --git a/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md b/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md
new file mode 100644
index 000000000..7e691cb5a
--- /dev/null
+++ b/docs/branch-review-records/7592e6cdace9aa2f142a902b7b827c4174a89110aa0e17889c30b17eae50500d.record.md
@@ -0,0 +1 @@
+| 2026-09-06 | dependabot/github_actions/github-actions-91ab6ea131 (PR #2647) | 2df2db0b5a6402b5f9b7e46ccf0313a4341a069d | Run PR sweep: CI fix | Static PR checks fixed: check:github-actions failed because the reviewed-SHA allowlist did not include the bumped anthropics/claude-code-action commit (v1.0.210 -> v1.0.215). Verified the upstream diff between the two pinned commits directly (git diff on a fresh clone of anthropics/claude-code-action): only Claude Code/Agent SDK version-number bumps, no permissions/secrets/trust-boundary change. Added the reviewed allowlist entry. No unresolved review threads. | npm run check:github-actions (passed); npx vitest run tests/github-action-pins.test.ts (7 passed); no provider-backed checks run |
diff --git a/scripts/github-action-pins.mjs b/scripts/github-action-pins.mjs
index 3d4d591e2..b6e680950 100644
--- a/scripts/github-action-pins.mjs
+++ b/scripts/github-action-pins.mjs
@@ -51,6 +51,12 @@ const reviewedActionPins = new Map([
       // encoded branch names in GitHub links, and .gitattributes — no change
       // to permissions, secrets handling, or the action's trust boundary.
       ["a874e9ecd7bb36efdad65429c6b35815f5a08f10", "v1.0.210"],
+      // Reviewed 2026-09-06 for PR #2647 (Dependabot github-actions group):
+      // annotated tag v1.0.215 peels to this commit. Diff v1.0.210...v1.0.215
+      // is only Claude Code (2.1.251->2.1.260) and Agent SDK (0.3.251->0.3.260)
+      // version bumps in action.yml/run.ts/package.json/bun.lock — no change
+      // to permissions, secrets handling, or the action's trust boundary.
+      ["ef8bb1e43bf303cff727a1dd0b8837029fe982a2", "v1.0.215"],
     ]),
   ],
   // Reviewed 2026-08-13 for the credential-isolated Run PR operator: annotated