diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5c4eb5f..f385e320 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           test "$status" -eq 0 || test "$status" -eq 1
 
       - name: Upload governance artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: agt-governance-${{ github.sha }}
           path: |
@@ -150,7 +150,7 @@ jobs:
         run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: benchmark-results
           path: benchmarks/
diff --git a/.github/workflows/confinement.yml b/.github/workflows/confinement.yml
index af73319d..370894b8 100644
--- a/.github/workflows/confinement.yml
+++ b/.github/workflows/confinement.yml
@@ -45,7 +45,7 @@ jobs:
           timeout 180s python -m pytest tests/confinement -v --tb=short -o faulthandler_timeout=30 --junitxml=confinement-evidence/results.xml 2>&1 | tee confinement-evidence/tests.txt
       - name: Retain reproducible evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: confinement-evidence
           path: confinement-evidence/
diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
index 2f1a9b6f..4f88776a 100644
--- a/.github/workflows/release-validation.yml
+++ b/.github/workflows/release-validation.yml
@@ -101,7 +101,7 @@ jobs:
           test "$status" -eq 0 || test "$status" -eq 1
 
       - name: Upload governance artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: agt-governance-${{ github.sha }}
           path: |
@@ -133,7 +133,7 @@ jobs:
         run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.0
         with:
           name: benchmark-results
           path: benchmarks/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9c1ee5d9..7b1664e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,7 +77,7 @@ jobs:
           done
           test "$index" -eq 2
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 8a645941..42ca22da 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -26,7 +26,7 @@ jobs:
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom
           path: sbom.spdx.json