diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 8d0305a2..9f8161e3 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -14,6 +14,10 @@ permissions:
 
 jobs:
   review:
+    # Dependabot-triggered runs cannot read repo secrets, so the Claude review
+    # action always fails with a red X on dependabot PRs. Skip them (same
+    # convention as scripts/check-changesets.mjs).
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 25
     permissions: