diff --git a/.github/AGENTS.md b/.github/AGENTS.md
index a851779..a7f6d60 100644
--- a/.github/AGENTS.md
+++ b/.github/AGENTS.md
@@ -178,9 +178,8 @@ Cancels in-progress runs for same branch
 * Security
 * Adherence to AGENTS.md guidelines
 
-**Secrets required**:
-
-* `ANTHROPIC_API_KEY`
+**Authentication**: workload identity federation through the repository-level
+`ANTHROPIC_*` Actions variables; no secret is needed.
 
 ## Git Conventions
 
@@ -268,9 +267,8 @@ Cancels in-progress runs for same branch
 * `CODECOV_TOKEN` - Codecov coverage reporting
 * `SONAR_TOKEN` - SonarCloud analysis
 
-**Claude Code**:
-
-* `ANTHROPIC_API_KEY` - Claude API access
+**Claude Code**: no secret; workload identity federation through the
+repository-level `ANTHROPIC_*` Actions variables.
 
 ## Debugging CI Failures
 
diff --git a/.github/workflows/claude-code-automation-pr-review.yml b/.github/workflows/claude-code-automation-pr-review.yml
index 06d7330..07e8d5e 100644
--- a/.github/workflows/claude-code-automation-pr-review.yml
+++ b/.github/workflows/claude-code-automation-pr-review.yml
@@ -26,7 +26,10 @@ jobs:
       - name: Run Claude Code PR Review
         uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d  # v1.0.266
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
           track_progress: ${{ github.event_name == 'pull_request' && contains(fromJSON('["opened", "synchronize", "ready_for_review", "reopened"]'), github.event.action) }}
           use_sticky_comment: true
           claude_args: |
diff --git a/docs/foundry/getting-started.md b/docs/foundry/getting-started.md
index 1661289..5f1476d 100644
--- a/docs/foundry/getting-started.md
+++ b/docs/foundry/getting-started.md
@@ -112,7 +112,7 @@ These services are active automatically at the organisation level:
 | [CodeQL](https://github.com/aignostics/foundry-python-core/security/code-scanning) | Static security analysis | Runs weekly (Tuesdays 3:22 AM UTC) via included workflow |
 | [CodeCov](https://app.codecov.io/gh/aignostics/foundry-python-core) | Coverage tracking & PR comments | Org-level; coverage uploads automatic |
 | [Dependabot](https://github.com/aignostics/foundry-python-core/settings/security_analysis) | Dependency vulnerability alerts | Enabled by default via enterprise policy |
-| [Claude Code](https://github.com/aignostics/foundry-python-core/actions) | AI-powered PR reviews (`claude` label) | `ANTHROPIC_API_KEY` is org-wide; no setup required |
+| [Claude Code](https://github.com/aignostics/foundry-python-core/actions) | AI-powered PR reviews (`claude` label) | Workload identity federation through the `ANTHROPIC_*` Actions variables; org-wide for private and internal repositories, set on the repository for public ones |
 
 ### Renovate