diff --git a/.github/workflows/analyze-hook.yml b/.github/workflows/analyze-hook.yml
index 9a88c295..a7a377f9 100644
--- a/.github/workflows/analyze-hook.yml
+++ b/.github/workflows/analyze-hook.yml
@@ -2,7 +2,7 @@ name: Analyze Hook Submission
 
 on:
   issues:
-    types: [opened]
+    types: [labeled]
 
 concurrency:
   group: analyze-hook-${{ github.event.issue.number }}
@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   analyze:
-    if: contains(github.event.issue.labels.*.name, 'submission') || contains(github.event.issue.title, 'hook:')
+    if: github.event.label.name == 'submission'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -27,12 +27,12 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-      - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf
+      - uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1.0.75
         id: claude
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           show_full_output: true
-          claude_args: '--allowedTools "Bash(curl:*api.etherscan.*),Bash(curl:*api-sepolia.etherscan.*),Bash(curl:*api.arbiscan.*),Bash(curl:*api-sepolia.basescan.*),Bash(curl:*api.basescan.*),Bash(curl:*api.polygonscan.*),Bash(git*),Bash(gh*),Bash(python3*),Read,Glob,Grep,Write"'
+          claude_args: '--allowedTools "Bash(curl *),Bash(git *),Bash(gh *),Bash(python3 *),Read,Glob,Grep,Write"'
           prompt: |
             Analyze the hook submission in issue #${{ github.event.issue.number }}.
 
diff --git a/.github/workflows/review-hook.yml b/.github/workflows/review-hook.yml
index 29271dbe..819854bd 100644
--- a/.github/workflows/review-hook.yml
+++ b/.github/workflows/review-hook.yml
@@ -33,7 +33,7 @@ jobs:
             echo "No hook files changed, skipping review."
           fi
 
-      - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf
+      - uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1.0.75
         if: steps.changed.outputs.hooks == 'true'
         id: claude
         with:
@@ -42,7 +42,7 @@ jobs:
           show_full_output: true
           claude_args: >-
             --json-schema '{"type":"object","properties":{"review_body":{"type":"string"},"outcome":{"type":"string","enum":["APPROVE","REQUEST_CHANGES"]}},"required":["review_body","outcome"]}'
-            --allowedTools "Bash(curl:*api.etherscan.*),Bash(curl:*api-sepolia.etherscan.*),Bash(curl:*api.arbiscan.*),Bash(curl:*api-sepolia.basescan.*),Bash(curl:*api.basescan.*),Bash(curl:*api.polygonscan.*),Bash(python3:*),Read,Glob,Grep"
+            --allowedTools "Bash(curl *),Bash(python3 *),Read,Glob,Grep"
           prompt: |
             Review this PR by following the instructions in .claude/prompts/review-hook.md.
             Verify each hook file's flags, properties, and metadata against the on-chain source code.