diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml
index 51577a8..285f726 100644
--- a/.github/workflows/cla.yaml
+++ b/.github/workflows/cla.yaml
@@ -19,10 +19,11 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Upstream contributor-assistant/github-action was archived 2026-03-23
-        # still on Node 20 (deprecated 2026-06-02). This fork bumps the
-        # runtime to Node 24 and fixes a false-failure where the check
-        # would go red after logging "All contributors have signed".
-        uses: iainmcgin/cla-github-action@eeb7f3ffa305b600c6e873578b9ea78ca11a5f3e  # v2.7.1
+        # still on Node 20 (deprecated 2026-06-02). This fork bumps to Node 24
+        # and adds: an impersonation guard (PR opener must be an author or
+        # co-author of at least one commit), Co-authored-by trailer support,
+        # and actionable unlinked-email guidance.
+        uses: iainmcgin/cla-github-action@1ecf0d2f19b665777f5b0cda149104238cc6c493
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: