diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d89dad35..85e841f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -573,7 +573,7 @@ jobs:
           --skip serializer_arrow_usgs --skip serializer_auto_usgs --report "$RUNNER_TEMP/ir-report-${{ matrix.shard }}.json"
 
     # The verdict, PASS or FAIL, for perf-ir-report, or the placeholder if the gate wrote none.
-    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       if: always()
       with:
         name: perf-ir-report-${{ matrix.shard }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ea00e39f..50d1b94e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -94,7 +94,7 @@ jobs:
 
       # Archive SARIF for audit trail
       - name: Upload SARIF artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: codeql-sarif-${{ matrix.language }}
           path: sarif-results
diff --git a/.github/workflows/fuzz-smoke.yml b/.github/workflows/fuzz-smoke.yml
index 38e0c5ec..636d44c7 100644
--- a/.github/workflows/fuzz-smoke.yml
+++ b/.github/workflows/fuzz-smoke.yml
@@ -138,7 +138,7 @@ jobs:
 
     - name: Upload crash artifacts
       if: failure()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: fuzz-crash-artifacts
         path: rust/fuzz/artifacts/
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 8464a74e..83af96e5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -294,7 +294,7 @@ jobs:
           manylinux: ${{ matrix.manylinux || 'auto' }}
           rust-toolchain: stable
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: wheels-${{ matrix.target }}
           path: dist
@@ -315,7 +315,7 @@ jobs:
           args: --out dist
           rust-toolchain: stable
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sdist
           path: dist
diff --git a/.github/workflows/security-deep.yml b/.github/workflows/security-deep.yml
index 56ee18a5..7bbc6d69 100644
--- a/.github/workflows/security-deep.yml
+++ b/.github/workflows/security-deep.yml
@@ -107,7 +107,7 @@ jobs:
     # which would otherwise die with the ephemeral runner.
     - name: Upload crash artifacts
       if: failure()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: extended-fuzz-crash-artifacts
         path: rust/fuzz/artifacts/
@@ -182,7 +182,7 @@ jobs:
     # ephemeral runner.
     - name: Upload crash artifacts
       if: failure()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: atheris-crash-artifacts
         path: tests/fuzzing/artifacts/
@@ -325,7 +325,7 @@ jobs:
         cat "$REPORT"
 
     - name: Archive security report
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: security-deep-report
         path: reports/security/
diff --git a/.github/workflows/security-fast.yml b/.github/workflows/security-fast.yml
index c75298a0..55eb3d69 100644
--- a/.github/workflows/security-fast.yml
+++ b/.github/workflows/security-fast.yml
@@ -118,7 +118,7 @@ jobs:
 
     - name: Upload report
       if: always()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: pip-audit-report
         path: pip-audit-report.json
diff --git a/.github/workflows/security-medium.yml b/.github/workflows/security-medium.yml
index 3c55dcc0..86e550b2 100644
--- a/.github/workflows/security-medium.yml
+++ b/.github/workflows/security-medium.yml
@@ -61,7 +61,7 @@ jobs:
         echo "cachekit-rs has zero unsafe functions"
 
     - name: Archive geiger report
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       if: always()
       with:
         name: geiger-report