diff --git a/.github/workflows/claude-code-review-run.yml b/.github/workflows/claude-code-review-run.yml
index 8e54f588c..748b4f627 100644
--- a/.github/workflows/claude-code-review-run.yml
+++ b/.github/workflows/claude-code-review-run.yml
@@ -100,7 +100,9 @@ jobs:
       - name: Run Claude Code Review
         id: review
         continue-on-error: true # always report status below, even on failure
-        uses: anthropics/claude-code-action@v1
+        # pinned: v1 (Claude Code 2.1.216) fails every Bash call with
+        # "bwrap: Can't create file at /home/.mcp.json: Permission denied"
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1 @ 2.1.215
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Provided explicitly so the review can post on fork PRs; also required
diff --git a/.github/workflows/claude-issue-agent-run.yml b/.github/workflows/claude-issue-agent-run.yml
index da671e021..188f90f4d 100644
--- a/.github/workflows/claude-issue-agent-run.yml
+++ b/.github/workflows/claude-issue-agent-run.yml
@@ -49,7 +49,9 @@ jobs:
           fetch-depth: 0
 
       - name: Run Claude
-        uses: anthropics/claude-code-action@v1
+        # pinned: v1 (Claude Code 2.1.216) fails every Bash call with
+        # "bwrap: Can't create file at /home/.mcp.json: Permission denied"
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1 @ 2.1.215
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/claude-issue-agent.yml b/.github/workflows/claude-issue-agent.yml
index 3310e93fb..5283ef323 100644
--- a/.github/workflows/claude-issue-agent.yml
+++ b/.github/workflows/claude-issue-agent.yml
@@ -45,7 +45,9 @@ jobs:
           fetch-depth: 0
 
       - name: Run Claude PR Labeler
-        uses: anthropics/claude-code-action@v1
+        # pinned: v1 (Claude Code 2.1.216) fails every Bash call with
+        # "bwrap: Can't create file at /home/.mcp.json: Permission denied"
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1 @ 2.1.215
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}