diff --git a/.changeset/patch-auto-generated-pr-5729.md b/.changeset/patch-auto-generated-pr-5729.md
new file mode 100644
index 00000000000..e884d994d5e
--- /dev/null
+++ b/.changeset/patch-auto-generated-pr-5729.md
@@ -0,0 +1,8 @@
+---
+"gh-aw": patch
+---
+
+Auto-generated changeset for pull request #5729 — no description provided.
+
+This is a default `patch` changeset because the PR description is empty; internal or tooling changes are considered patch-level.
+
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 8a7a03e3fe5..3ab30958c6f 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -1793,6 +1793,7 @@ jobs:
           {
             "mcpServers": {
               "safeinputs": {
+                "type": "http",
                 "url": "http://localhost:$GH_AW_SAFE_INPUTS_PORT",
                 "headers": {
                   "Authorization": "Bearer $GH_AW_SAFE_INPUTS_API_KEY"
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index e5577baff77..42744f2d5a3 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -5969,19 +5969,19 @@ jobs:
       - name: Download Go modules
         run: go mod download
       - name: Generate SBOM (SPDX format)
-        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
+        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0
         with:
           artifact-name: sbom.spdx.json
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Generate SBOM (CycloneDX format)
-        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
+        uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0
         with:
           artifact-name: sbom.cdx.json
           format: cyclonedx-json
           output-file: sbom.cdx.json
       - name: Upload SBOM artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: sbom-artifacts
           path: |
diff --git a/pkg/workflow/safe_inputs.go b/pkg/workflow/safe_inputs.go
index e8a8bb280d7..937850a2adf 100644
--- a/pkg/workflow/safe_inputs.go
+++ b/pkg/workflow/safe_inputs.go
@@ -543,10 +543,8 @@ func renderSafeInputsMCPConfigWithOptions(yaml *strings.Builder, safeInputs *Saf
 	// Use HTTP transport configuration
 	yaml.WriteString("              \"" + constants.SafeInputsMCPServerID + "\": {\n")
 
-	// Add type field for HTTP
-	if includeCopilotFields {
-		yaml.WriteString("                \"type\": \"http\",\n")
-	}
+	// Add type field for HTTP (required by MCP specification for HTTP transport)
+	yaml.WriteString("                \"type\": \"http\",\n")
 
 	// HTTP URL using environment variable
 	if includeCopilotFields {
diff --git a/pkg/workflow/safe_inputs_http_integration_test.go b/pkg/workflow/safe_inputs_http_integration_test.go
index 2a473b027dc..f7a9ff25954 100644
--- a/pkg/workflow/safe_inputs_http_integration_test.go
+++ b/pkg/workflow/safe_inputs_http_integration_test.go
@@ -91,9 +91,9 @@ Test safe-inputs HTTP server
 		}
 	}
 
-	// Verify health check
+	// Verify health check (health endpoint doesn't require auth)
 	healthCheckItems := []string{
-		"curl -s -f -H \"Authorization: Bearer",
+		"curl -s -f http://localhost:$GH_AW_SAFE_INPUTS_PORT/health",
 		"Safe Inputs MCP server is ready",
 		"ERROR: Safe Inputs MCP server failed to start",
 	}
@@ -322,11 +322,10 @@ Test readiness check
 
 	yamlStr := string(lockContent)
 
-	// Verify readiness check loop
+	// Verify readiness check loop (health endpoint doesn't require auth)
 	readinessChecks := []string{
 		"for i in {1..10}; do",
-		"if curl -s -f -H \"Authorization: Bearer",
-		"http://localhost:$GH_AW_SAFE_INPUTS_PORT/",
+		"if curl -s -f http://localhost:$GH_AW_SAFE_INPUTS_PORT/health",
 		"Safe Inputs MCP server is ready",
 		"break",
 		"if [ $i -eq 10 ]; then",