diff --git a/.github/workflows/build-buildtools-musl.yml b/.github/workflows/build-buildtools-musl.yml
index 95efbd8..3e54ec2 100644
--- a/.github/workflows/build-buildtools-musl.yml
+++ b/.github/workflows/build-buildtools-musl.yml
@@ -61,7 +61,7 @@ jobs:
               echo "==> $(du -sh /out/${PKG}.tar.gz | cut -f1)"
             '
       - name: Upload CMake musl archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: cmake-musl-${{ inputs.cmake_version }}
           path: /tmp/out/cmake-${{ inputs.cmake_version }}-linux-x86_64-musl.tar.gz
@@ -95,7 +95,7 @@ jobs:
               echo "==> $(du -sh /out/ninja-${NINJA_VERSION}-linux-musl.tar.gz | cut -f1)"
             '
       - name: Upload Ninja musl archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: ninja-musl-${{ inputs.ninja_version }}
           path: /tmp/out/ninja-${{ inputs.ninja_version }}-linux-musl.tar.gz
diff --git a/.github/workflows/build-llvm-linux.yml b/.github/workflows/build-llvm-linux.yml
index 038f919..d7ea9e1 100644
--- a/.github/workflows/build-llvm-linux.yml
+++ b/.github/workflows/build-llvm-linux.yml
@@ -189,7 +189,7 @@ jobs:
             '
 
       - name: Upload archive as workflow artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: llvm-rhel${{ matrix.major }}-${{ inputs.llvm_version }}
           path: /tmp/llvm-output/LLVM-${{ inputs.llvm_version }}-Linux-X64-rhel${{ matrix.major }}.tar.xz
@@ -290,7 +290,7 @@ jobs:
             '
 
       - name: Upload musl archive as workflow artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: llvm-musl-${{ inputs.llvm_version }}
           path: /tmp/llvm-output/LLVM-${{ inputs.llvm_version }}-Linux-X64-musl.tar.xz
diff --git a/.github/workflows/build-sqlite-static.yml b/.github/workflows/build-sqlite-static.yml
index 1bad8be..04f849e 100644
--- a/.github/workflows/build-sqlite-static.yml
+++ b/.github/workflows/build-sqlite-static.yml
@@ -91,7 +91,7 @@ jobs:
             '
 
       - name: Upload sqlite3 binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: sqlite3-${{ matrix.family }}-${{ inputs.sqlite_version }}
           path: /tmp/out/sqlite3-${{ inputs.sqlite_version }}-linux-x64-${{ matrix.family }}
diff --git a/.github/workflows/check-updates.yml b/.github/workflows/check-updates.yml
index ae2e7d2..a24ba7c 100644
--- a/.github/workflows/check-updates.yml
+++ b/.github/workflows/check-updates.yml
@@ -85,7 +85,7 @@ jobs:
 
       - name: Upload JSON report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: update-report-${{ github.run_id }}
           path: /tmp/updates.json
diff --git a/.github/workflows/sign-and-scan.yml b/.github/workflows/sign-and-scan.yml
index c0ba909..8dc091b 100644
--- a/.github/workflows/sign-and-scan.yml
+++ b/.github/workflows/sign-and-scan.yml
@@ -88,7 +88,7 @@ jobs:
       # ── Upload reports ──────────────────────────────────────────────────────
       - name: Upload VirusTotal reports
         if: ${{ always() && inputs.scan }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: virustotal-reports-${{ github.run_id }}
           path: dist/vt-reports/
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index ef7a26e..58f3035 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload receipts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: install-receipts-${{ matrix.os_flag }}
           path: /tmp/receipts/