diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca76cbf..8f403ce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
       floor_pg: ${{ steps.pg.outputs.floor_pg }}
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Full history needed so BASE and HEAD below are both reachable
           # for `git diff`.
@@ -232,7 +232,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: make lint
         # Deliberately not pre-initializing the .vendor/linter submodule via
         # `submodules:` above -- letting `make lint` self-init it (lint.mk)
@@ -271,7 +271,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.pg }}
         run: pg-start ${{ matrix.pg }}
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Test on PostgreSQL ${{ matrix.pg }}
         run: make test
       - name: Install count_nulls
@@ -375,7 +375,7 @@ jobs:
           pg_ctlcluster ${{ matrix.old_pg }} test start
           pg_isready -t 30
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install count_nulls into old cluster
         run: make install
       - name: Prepare the old cluster (install + dependency guard), twin databases
@@ -508,7 +508,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.pg }}
         run: pg-start ${{ matrix.pg }}
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install rsync
         run: apt-get install -y rsync
       - name: Snapshot filesystem extension control files (pre-pgtap baseline)
@@ -608,7 +608,7 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Verify all jobs are listed in needs
         # Ensures this job won't silently ignore a newly-added job that was
         # omitted from the needs list above.
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 51f5c39..5e673ee 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -44,6 +44,11 @@ jobs:
       contents: read
       pull-requests: write   # post the review comments
       checks: read           # read sibling check-runs for the cost gate
+      # No narrower cache-write-only scope exists. Without this, the
+      # action's internal cache-save step silently fails ("Cache
+      # reservation failed: cache write denied: token has no writable
+      # scopes") while the job still reports success.
+      actions: write
     steps:
       # COST GATE: the paid Claude review is the last thing to run. Wait for the
       # PR head's OTHER check-runs to finish and only proceed if they are clean.
@@ -91,7 +96,7 @@ jobs:
         # Intentionally tracks the major-version tag (not a pinned SHA) so
         # upstream fixes are picked up automatically. No repository:/ref:
         # override - see the SECURITY comment at the top of this file for why.
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -124,3 +129,10 @@ jobs:
           # provided, so no GitHub comments were posted"). Every review run
           # before this fix has been silently invisible on GitHub.
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }} --comment'
+          # A bare `prompt:` (no @claude mention) runs in "agent mode",
+          # which only starts MCP servers listed here, not whatever the
+          # invoked plugin's own frontmatter declares. Without this, the
+          # inline-comment tool never starts and every review silently
+          # falls back to one consolidated PR comment instead of real
+          # per-line inline comments.
+          claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 7d1656c..dc559d1 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Checkout repository
         # Intentionally tracks the major-version tag (not a pinned SHA) so
         # upstream fixes are picked up automatically.
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false