diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..5419ca0 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -42,3 +42,23 @@ jobs:
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
 
+      # The run's turn-by-turn log, kept whatever the outcome. When the review
+      # fails, the job log reports only the aggregate — `is_error: true` with a
+      # `permission_denials_count` — and never names the tool that was denied,
+      # which is the one fact needed to fix it. That detail lives in this file,
+      # written to the runner's temp dir and otherwise discarded with the runner.
+      # Runs are cheap to re-trigger but not to reproduce: which tool the model
+      # reaches for varies per PR, so a failure not captured when it happens may
+      # not recur on demand.
+      - name: Upload review execution log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: claude-review-execution-log
+          # Falls back to the action's documented temp path: a step that FAILED
+          # never sets its outputs, so execution_file is empty in exactly the
+          # case this upload exists for.
+          path: ${{ steps.claude-review.outputs.execution_file || format('{0}/claude-execution-output.json', runner.temp) }}
+          if-no-files-found: warn
+          retention-days: 14
+