diff --git a/.github/workflows/debug-oauth-probe.yml b/.github/workflows/debug-oauth-probe.yml
new file mode 100644
index 000000000..244188d00
--- /dev/null
+++ b/.github/workflows/debug-oauth-probe.yml
@@ -0,0 +1,33 @@
+name: debug-oauth-probe
+on:
+  pull_request:
+    paths: ['.github/workflows/debug-oauth-probe.yml']
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  probe:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Run pinned claude-code-action with trivial prompt
+        id: cca
+        continue-on-error: true
+        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1.0.174
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          prompt: "Reply with exactly: ACTION_PROBE_OK"
+          track_progress: true
+          claude_args: --model claude-sonnet-4-6 --max-turns 2
+      - name: Dump SDK result detail
+        if: always()
+        env:
+          EXECUTION_FILE: ${{ steps.cca.outputs.execution_file }}
+        run: |
+          echo "outcome=${{ steps.cca.outcome }}"
+          if [ -n "${EXECUTION_FILE:-}" ] && [ -f "$EXECUTION_FILE" ]; then
+            jq '.[-1] | {subtype, is_error, api_error_status, num_turns, duration_ms, total_cost_usd, result: ((.result // "")|tostring|.[0:600])}' "$EXECUTION_FILE" || tail -3 "$EXECUTION_FILE"
+          else
+            echo "(no execution file)"
+          fi