diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..43793e6 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -12,12 +12,17 @@ on:
 
 jobs:
   claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-
+    # Skip on bot-authored PRs (Copilot, Dependabot). claude-code-action
+    # exchanges the workflow's OIDC token for a GitHub App installation
+    # token; the server-side exchange rejects actors without repo write
+    # access. The action's allowed_bots input would normally fix this,
+    # but v1.0.88 has a client-side bug that crashes on actors without
+    # the "[bot]" suffix (Copilot's login is "Copilot"). Tracked in
+    # anthropics/claude-code-action#1133; fix PRs #1144/#1213 unmerged.
+    # Remove this guard once the pin is lifted and allowed_bots works.
+    if: >-
+      github.event.pull_request.user.login != 'Copilot' &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -33,7 +38,11 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        # Pinned to v1.0.88 to avoid the ENOENT symlink / tsconfig.json
+        # "directory mismatch" regression introduced in v1.0.89.
+        # See upstream issues anthropics/claude-code-action#1187,
+        # #1205, and #1220. Revisit once a fix ships upstream.
+        uses: anthropics/claude-code-action@1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47 # v1.0.88
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 6b15fac..836a6b0 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -32,7 +32,11 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        # Pinned to v1.0.88 to avoid the ENOENT symlink / tsconfig.json
+        # "directory mismatch" regression introduced in v1.0.89.
+        # See upstream issues anthropics/claude-code-action#1187,
+        # #1205, and #1220. Revisit once a fix ships upstream.
+        uses: anthropics/claude-code-action@1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47 # v1.0.88
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}