diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index facef7d..5e53f65 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -1,7 +1,12 @@
 name: Claude Code Review
 
+# Do not switch this to `pull_request_target`.
+# Anthropic's token-exchange endpoint rejects OIDC tokens minted for that
+# event, so the job fails with "401 Unauthorized - Invalid OIDC token"
+# before Claude ever runs. See
+# https://github.com/anthropics/claude-code-action/issues/713
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
     # Optional: Only run on specific file changes
     # paths:
@@ -21,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: read
       issues: read
       id-token: write
 
@@ -30,7 +35,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Run Claude Code Review
         id: claude-review