diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index be3c4ee..ffebc1a 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -67,8 +67,21 @@ jobs:
       id-token: write
       actions: read
     steps:
+      # Review under the CI app identity rather than the job token: it is what
+      # lets the action resolve stale review threads (the shared action gates
+      # --resolve-threads on github_identity_token being non-empty).
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.CI_APP_ID }}
+          private-key: ${{ secrets.MEGA_CI_APP_PK }}
+          owner: megaeth-labs
+          repositories: documentation
+
       - uses: actions/checkout@v4
         with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
           fetch-depth: 1
 
       - name: Detect claude workflow changes
@@ -92,4 +105,5 @@ jobs:
         if: steps.workflow-change.outputs.skip != 'true'
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          github_identity_token: ${{ steps.app-token.outputs.token }}
           allowed_bots: "mega-putin"