diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ec3f23..9fa9e8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,7 +115,7 @@ jobs:
         run: .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json
 
       - name: Upload governance artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: agt-governance-${{ github.sha }}
           path: |
@@ -148,7 +148,7 @@ jobs:
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: benchmark-results
           path: benchmarks/
diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
index 54fe293..1ceda38 100644
--- a/.github/workflows/release-validation.yml
+++ b/.github/workflows/release-validation.yml
@@ -98,7 +98,7 @@ jobs:
         run: .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json
 
       - name: Upload governance artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: agt-governance-${{ github.sha }}
           path: |
@@ -131,7 +131,7 @@ jobs:
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: benchmark-results
           path: benchmarks/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 90c12e3..f054d5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
           /tmp/ca2a-sdist/bin/python -c 'import importlib.metadata, os, ca2a_runtime; expected=os.environ["REF_NAME"][1:]; assert importlib.metadata.version("ca2a-runtime") == expected; assert ca2a_runtime.__version__ == expected'
           /tmp/ca2a-sdist/bin/ca2a --help
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 8a64594..42ca22d 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -26,7 +26,7 @@ jobs:
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom
           path: sbom.spdx.json