diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b304227..02415c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,12 +61,12 @@ jobs:
         run: |
           test "$(find npm-dist -maxdepth 1 -type f -name '*.tgz' | wc -l)" -eq 1
           node tools/smoke_npm.mjs npm-dist/*.tgz
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: python-distributions
           path: dist/*
           if-no-files-found: error
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: npm-distribution
           path: npm-dist/*.tgz
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 8bfb244..99b9fc9 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -22,7 +22,7 @@ jobs:
       - run: python -m pip install --require-hashes -r requirements/test.txt
       - run: python -m pip install --no-deps -e .
       - run: cyclonedx-py environment --output-format json --output-file sbom.cdx.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agentrust-telemetry-sbom
           path: sbom.cdx.json