diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4dfbebe..c71beff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
       - run: python -m venv .venv && .venv/bin/python -m pip install -e '.[dev]'
       - run: mkdir -p artifacts && PROOFLINE_HOME="$RUNNER_TEMP/proofline" .venv/bin/proofline seed
       - run: PROOFLINE_HOME="$RUNNER_TEMP/proofline" .venv/bin/proofline check-decisions --format sarif --output artifacts/decision-health.sarif
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: decision-health-sarif
           path: artifacts/decision-health.sarif
@@ -120,7 +120,7 @@ jobs:
       - run: python -m venv .venv && .venv/bin/python -m pip install -e '.[dev]'
       - run: mkdir -p artifacts && PROOFLINE_HOME="$RUNNER_TEMP/proofline" .venv/bin/proofline seed
       - run: PROOFLINE_HOME="$RUNNER_TEMP/proofline" .venv/bin/proofline check-impacts --format sarif --output artifacts/decision-impact.sarif
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: decision-impact-sarif
           path: artifacts/decision-impact.sarif
diff --git a/.github/workflows/desktop-artifacts.yml b/.github/workflows/desktop-artifacts.yml
index 331e477..5aad801 100644
--- a/.github/workflows/desktop-artifacts.yml
+++ b/.github/workflows/desktop-artifacts.yml
@@ -249,7 +249,7 @@ jobs:
           python scripts/windows_desktop_receipt.py @ReceiptArgs
 
       - name: Upload isolated workflow artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: proofline-${{ matrix.platform }}-${{ inputs.release_grade && 'release-grade' || 'experimental' }}-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index b0f7a1e..06a5b98 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -26,7 +26,7 @@ jobs:
       - run: python -m twine check dist/*
       - run: python scripts/qualify_python_artifact.py --artifact dist/proofline_evidence-2.0.2-py3-none-any.whl --expected-version 2.0.2
       - run: python scripts/qualify_python_artifact.py --artifact dist/proofline_evidence-2.0.2.tar.gz --expected-version 2.0.2
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: proofline-evidence-2.0.2-dist
           path: dist/*