diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cbc30bd..ab639e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -142,7 +142,7 @@ jobs:
       - name: Measure (advisory — evidence, not a gate)
         run: cargo llvm-cov --workspace --lcov --output-path lcov.info
       - name: Upload coverage evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-lcov
           path: lcov.info
@@ -156,7 +156,7 @@ jobs:
       # Round-tripping the artifact just uploaded is a real exercise of the
       # same action at the same pin, and costs one small file.
       - name: Fetch it back — the action release.yml depends on, exercised here
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: coverage-lcov
           path: rehearsal
diff --git a/.github/workflows/deposit-layer.yml b/.github/workflows/deposit-layer.yml
index 2421ac1..aa8a864 100644
--- a/.github/workflows/deposit-layer.yml
+++ b/.github/workflows/deposit-layer.yml
@@ -331,7 +331,7 @@ jobs:
           fi
 
       - name: Upload the oci-layout (artifact of record)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: layer-${{ inputs.layer }}-oci-layout
           path: layer-layout
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 2ab5a0c..b0bc3c2 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -61,7 +61,7 @@ jobs:
             -- -max_total_time=${{ steps.dur.outputs.secs }} -rss_limit_mb=4096
       - name: Upload any crash corpus
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: fuzz-crash-${{ matrix.target }}
           path: fuzz/artifacts/
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index bd6aa80..c8d0127 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -44,7 +44,7 @@ jobs:
           cargo mutants --no-shuffle || true
       - name: Upload mutation evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: mutants-report-${{ github.run_id }}
           path: mutants.out
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 500b14c..e2018a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -259,19 +259,19 @@ jobs:
           tar -czf "$VIEWER" -C staging-serve .
           echo "VIEWER_ARCHIVE=$VIEWER" >> "$GITHUB_ENV"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: binary-${{ matrix.target }}
           path: ${{ env.ARCHIVE }}
           retention-days: 7
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: producer-${{ matrix.target }}
           path: ${{ env.PRODUCER_ARCHIVE }}
           retention-days: 7
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: serve-${{ matrix.target }}
           path: ${{ env.VIEWER_ARCHIVE }}
@@ -295,7 +295,7 @@ jobs:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download all build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: artifacts