diff --git a/.github/workflows/aeoess-aps-conformance.yml b/.github/workflows/aeoess-aps-conformance.yml
index 1092c4e6..8b21697f 100644
--- a/.github/workflows/aeoess-aps-conformance.yml
+++ b/.github/workflows/aeoess-aps-conformance.yml
@@ -53,7 +53,7 @@ jobs:
         run: python integrations/aeoess-aps/examples/emit_record.py --out trust-record.jwt
       - name: trace-tests level 0 (coverage report, not a conformance claim)
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: floating-${{ matrix.os }}-py${{ matrix.python }}
           path: |
@@ -99,7 +99,7 @@ jobs:
         run: python integrations/aeoess-aps/examples/emit_record.py --out trust-record.jwt
       - name: trace-tests level 0 (coverage report, not a conformance claim)
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: fixed-${{ matrix.os }}-py${{ matrix.python }}
           path: |
diff --git a/.github/workflows/capture-core-publish.yml b/.github/workflows/capture-core-publish.yml
index ad6f0992..4b1d3f28 100644
--- a/.github/workflows/capture-core-publish.yml
+++ b/.github/workflows/capture-core-publish.yml
@@ -98,7 +98,7 @@ jobs:
           print("installed core OK:", core.__version__)
           PY
           cd tests && /tmp/smoke/bin/python -m pytest . -q
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: packages/agentrust-capture-core/dist/
diff --git a/.github/workflows/chap-conformance.yml b/.github/workflows/chap-conformance.yml
index d5ae3289..ea05bfad 100644
--- a/.github/workflows/chap-conformance.yml
+++ b/.github/workflows/chap-conformance.yml
@@ -53,7 +53,7 @@ jobs:
         run: python integrations/chap/examples/emit_record.py --out trust-record.jwt
       - name: TRACE conformance
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: floating-${{ matrix.os }}-py${{ matrix.python }}
           path: trust-record.jwt
@@ -96,7 +96,7 @@ jobs:
         run: python integrations/chap/examples/emit_record.py --out trust-record.jwt
       - name: TRACE conformance
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: fixed-${{ matrix.os }}-py${{ matrix.python }}
           path: trust-record.jwt
diff --git a/.github/workflows/comply54-conformance.yml b/.github/workflows/comply54-conformance.yml
index 902dd21e..335a63ac 100644
--- a/.github/workflows/comply54-conformance.yml
+++ b/.github/workflows/comply54-conformance.yml
@@ -42,7 +42,7 @@ jobs:
         run: python integrations/comply54/examples/emit_record.py --out trust-record.jwt
       - name: TRACE conformance
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: conformance-${{ matrix.os }}-py${{ matrix.python }}
           path: |
diff --git a/.github/workflows/epilabs-epi-recorder-conformance.yml b/.github/workflows/epilabs-epi-recorder-conformance.yml
index ed23a051..2eede666 100644
--- a/.github/workflows/epilabs-epi-recorder-conformance.yml
+++ b/.github/workflows/epilabs-epi-recorder-conformance.yml
@@ -31,7 +31,7 @@ jobs:
         run: python integrations/epilabs-epi-recorder/examples/emit_record.py trust-record.json
       - name: TRACE conformance Level 0
         run: trace-tests verify --record trust-record.json --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: conformance-${{ matrix.os }}-py${{ matrix.python }}
           path: trust-record.json
diff --git a/.github/workflows/evidencebound-core-conformance.yml b/.github/workflows/evidencebound-core-conformance.yml
index eeca1dee..987ce68c 100644
--- a/.github/workflows/evidencebound-core-conformance.yml
+++ b/.github/workflows/evidencebound-core-conformance.yml
@@ -88,7 +88,7 @@ jobs:
       - name: Enforce declared TRACE Level 0
         run: trace-tests verify --record evidencebound.trace.json --level 0
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: evidencebound-conformance-${{ matrix.os }}-py${{ matrix.python }}
           path: |
diff --git a/.github/workflows/maintenance-report.yml b/.github/workflows/maintenance-report.yml
index 50097196..a616d513 100644
--- a/.github/workflows/maintenance-report.yml
+++ b/.github/workflows/maintenance-report.yml
@@ -22,7 +22,7 @@ jobs:
       - run: python scripts/maintenance_report.py | tee maintenance-report.txt
         env:
           GITHUB_TOKEN: ${{ github.token }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-maintenance-report
           path: maintenance-report.txt
diff --git a/.github/workflows/ramen-ai-cmcp-conformance.yml b/.github/workflows/ramen-ai-cmcp-conformance.yml
index 27edb5c1..c0621408 100644
--- a/.github/workflows/ramen-ai-cmcp-conformance.yml
+++ b/.github/workflows/ramen-ai-cmcp-conformance.yml
@@ -52,7 +52,7 @@ jobs:
             --appraisal-verifier https://ramenai.dev/trace/software-only
       - name: TRACE v0.2 conformance Level 0
         run: trace-tests verify --record trust-record.json --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: conformance-${{ matrix.os }}-py${{ matrix.python }}
           path: trust-record.json
diff --git a/.github/workflows/spendguard-conformance.yml b/.github/workflows/spendguard-conformance.yml
index 64aa7e16..120bc886 100644
--- a/.github/workflows/spendguard-conformance.yml
+++ b/.github/workflows/spendguard-conformance.yml
@@ -42,7 +42,7 @@ jobs:
         run: python integrations/spendguard/examples/emit_record.py --out trust-record.jwt
       - name: TRACE conformance
         run: trace-tests verify --record trust-record.jwt --level 0
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: conformance-${{ matrix.os }}-py${{ matrix.python }}
           path: |
diff --git a/.github/workflows/trace-adapters-publish.yml b/.github/workflows/trace-adapters-publish.yml
index cc256269..8bb53b54 100644
--- a/.github/workflows/trace-adapters-publish.yml
+++ b/.github/workflows/trace-adapters-publish.yml
@@ -78,7 +78,7 @@ jobs:
           /tmp/smoke/bin/python integrations/openshell/demo/build_signed_record.py --output /tmp/signed-record.json
           /tmp/smoke/bin/trace-tests verify --record /tmp/signed-record.json --level 0
           /tmp/smoke/bin/python -m pytest integrations/openshell/test_demo.py -q
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: trace-adapters-dist
           path: packages/agentrust-trace-adapters/dist/