diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 854d50240..3a42caa0f 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -244,7 +244,7 @@ jobs:
 
       - name: Upload embedding result
         if: steps.existing.outputs.skip != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: embedding-benchmark-result
           path: embedding-benchmark-result.json
diff --git a/.github/workflows/build-native-matrix.yml b/.github/workflows/build-native-matrix.yml
index 678642a16..7d888e6ac 100644
--- a/.github/workflows/build-native-matrix.yml
+++ b/.github/workflows/build-native-matrix.yml
@@ -133,7 +133,7 @@ jobs:
         run: napi build --release --target ${{ matrix.target }}
 
       - name: Upload native binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: native-${{ matrix.artifact_key }}
           path: crates/codegraph-core/*.node
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1331d39..fc002420e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -150,7 +150,7 @@ jobs:
         run: cargo test --release
 
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: native-host-${{ matrix.os }}
           path: crates/codegraph-core/*.node
@@ -587,7 +587,7 @@ jobs:
       # without re-running the full benchmark suite locally.
       - name: Upload benchmark JSON results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-results-json
           path: |
diff --git a/.github/workflows/codegraph-impact.yml b/.github/workflows/codegraph-impact.yml
index 49f4fda19..1c770e3ac 100644
--- a/.github/workflows/codegraph-impact.yml
+++ b/.github/workflows/codegraph-impact.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Save PR number
         run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
       - name: Upload impact artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codegraph-impact
           path: |
diff --git a/.github/workflows/perf-canary.yml b/.github/workflows/perf-canary.yml
index 51a25b9e1..f4c3c1454 100644
--- a/.github/workflows/perf-canary.yml
+++ b/.github/workflows/perf-canary.yml
@@ -107,7 +107,7 @@ jobs:
 
       - name: Upload canary result
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: incremental-canary-result
           path: incremental-canary-result.json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7f7b1db12..8f34c01fc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -340,7 +340,7 @@ jobs:
         run: npm run test:regression-guard
 
       - name: Upload benchmark history files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-files
           path: |
@@ -354,7 +354,7 @@ jobs:
       # gate in the Benchmark workflow). Separated from the history-files
       # artifact because consumers read different shapes.
       - name: Upload benchmark JSON results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-results-json
           path: |
diff --git a/.github/workflows/shield-license-compliance.yml b/.github/workflows/shield-license-compliance.yml
index b863a9613..84ff2fcda 100644
--- a/.github/workflows/shield-license-compliance.yml
+++ b/.github/workflows/shield-license-compliance.yml
@@ -152,7 +152,7 @@ jobs:
           fi
 
       - name: Upload license reports
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: license-compliance-reports
           path: license-reports/