diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 52cacd8..4754ea5 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -67,3 +67,7 @@ When adding new workflows:
 - `action.yml` - Action definition file
 - `package.json` - Contains version and scripts
 - `biome.json` - Lint and formatting configuration
+
+### claude-code-review.yml
+
+Automated review accepts human contributors and the `dependabot[bot]` actor. Dependabot-triggered runs read Dependabot secrets, so configure `CLAUDE_CODE_OAUTH_TOKEN` under repository Settings → Secrets and variables → Dependabot as well as the Actions secret used by human-triggered runs. Keep the token in GitHub's secret stores. Verify a real Dependabot-triggered review after configuration; a successful human-triggered review does not establish that the bot received credentials.
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..ff33b8c 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -35,6 +35,7 @@ jobs:
         id: claude-review
         uses: anthropics/claude-code-action@v1
         with:
+          allowed_bots: 'dependabot[bot]'
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'