diff --git a/.github/workflows/af01-assurance-proof.yml b/.github/workflows/af01-assurance-proof.yml
index f4104541..93739f55 100644
--- a/.github/workflows/af01-assurance-proof.yml
+++ b/.github/workflows/af01-assurance-proof.yml
@@ -221,7 +221,7 @@ jobs:
           git status --porcelain=v1 --untracked-files=all | tee /tmp/af01-source-status.txt
           test ! -s /tmp/af01-source-status.txt
       - name: Retain AF-01 assurance proof
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-assurance-proof
           path: |
diff --git a/.github/workflows/af01-scorecard.yml b/.github/workflows/af01-scorecard.yml
index 69aa7d80..826ccc13 100644
--- a/.github/workflows/af01-scorecard.yml
+++ b/.github/workflows/af01-scorecard.yml
@@ -83,7 +83,7 @@ jobs:
               raise SystemExit(f"unexpected repository identity: {remote.get('repo')!r}")
           PY
       - name: Retain per-check Scorecard evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-scorecard
           path: |
diff --git a/.github/workflows/af01-security.yml b/.github/workflows/af01-security.yml
index 0cb0859f..8b73f4c9 100644
--- a/.github/workflows/af01-security.yml
+++ b/.github/workflows/af01-security.yml
@@ -31,7 +31,7 @@ jobs:
             < /tmp/commandf-dependency-metadata.json \
             | tee af01-t020-dependency-inventory.json
       - name: Upload exact dependency inventory
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-t020-dependency-inventory
           path: af01-t020-dependency-inventory.json
@@ -84,7 +84,7 @@ jobs:
           command-arguments: advisories bans licenses sources
           log-level: warn
       - name: Upload cargo-deny proof identity
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-cargo-deny-proof
           path: af01-cargo-deny-proof.json
@@ -150,7 +150,7 @@ jobs:
           PY
       - name: Upload cargo-audit evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-rustsec-audit
           path: |
@@ -221,7 +221,7 @@ jobs:
           fail-on-no-inputs: true
       - name: Upload zizmor policy identity
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: af01-zizmor-proof
           path: af01-zizmor-proof.json
diff --git a/.github/workflows/cf11-multi-version-proof.yml b/.github/workflows/cf11-multi-version-proof.yml
index cff02b5f..6489c04e 100644
--- a/.github/workflows/cf11-multi-version-proof.yml
+++ b/.github/workflows/cf11-multi-version-proof.yml
@@ -177,7 +177,7 @@ jobs:
         run: test -z "$(git status --porcelain)"
 
       - name: Upload foundation evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cf11-multi-version-proof
           path: /tmp/cf11-multiversion/evidence.json
diff --git a/.github/workflows/cf11g-context-proof.yml b/.github/workflows/cf11g-context-proof.yml
index 457d2cc1..54eab2d2 100644
--- a/.github/workflows/cf11g-context-proof.yml
+++ b/.github/workflows/cf11g-context-proof.yml
@@ -63,7 +63,7 @@ jobs:
           test -z "$status"
 
       - name: Upload context determinism evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cf11g-context-proof
           path: /tmp/cf11g-context.sha256
diff --git a/.github/workflows/cf12-impact-proof.yml b/.github/workflows/cf12-impact-proof.yml
index aac7e1e4..b5cc2755 100644
--- a/.github/workflows/cf12-impact-proof.yml
+++ b/.github/workflows/cf12-impact-proof.yml
@@ -62,7 +62,7 @@ jobs:
           test -z "$status"
 
       - name: Upload impact determinism evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: cf12-impact-proof
           path: /tmp/cf12-impact.sha256
diff --git a/.github/workflows/cf13-quality-gate-proof.yml b/.github/workflows/cf13-quality-gate-proof.yml
index a8bf0f75..b26ce682 100644
--- a/.github/workflows/cf13-quality-gate-proof.yml
+++ b/.github/workflows/cf13-quality-gate-proof.yml
@@ -111,7 +111,7 @@ jobs:
           test -z "$status"
 
       - name: Upload CF-13 deterministic evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: cf13-quality-gate-proof
           path: /tmp/cf13-quality-gate-proof.env