diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5f93f06f..2d0386fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,7 +75,7 @@ jobs:
         run: make dist PROFILE=release-opt VERSION="${GITHUB_REF_NAME#v}"
 
       - name: Upload binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux-x64-gnu
           path: |
@@ -119,7 +119,7 @@ jobs:
         run: make dist PROFILE=release-opt VERSION="${GITHUB_REF_NAME#v}"
 
       - name: Upload binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux-arm64-gnu
           path: |
@@ -157,7 +157,7 @@ jobs:
         run: make dist PROFILE=release-opt VERSION="${GITHUB_REF_NAME#v}"
 
       - name: Upload binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: darwin-arm64
           path: |
@@ -253,7 +253,7 @@ jobs:
         run: NDK_HOME="$ANDROID_NDK_ROOT" make android-dist ANDROID_ABI=x86_64 PROFILE=release-opt VERSION="${GITHUB_REF_NAME#v}" PUBLISH=1
 
       - name: Upload arm64-v8a APK
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-arm64-v8a
           path: |
@@ -262,7 +262,7 @@ jobs:
             packages/android-arm64-v8a/THIRD-PARTY-NOTICES.txt
 
       - name: Upload armeabi-v7a APK
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-armeabi-v7a
           path: |
@@ -271,7 +271,7 @@ jobs:
             packages/android-armeabi-v7a/THIRD-PARTY-NOTICES.txt
 
       - name: Upload x86_64 APKs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-x86_64
           path: |
@@ -311,7 +311,7 @@ jobs:
         run: make dist PROFILE=release-opt VERSION="${GITHUB_REF_NAME#v}"
 
       - name: Upload binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: win32-x64-msvc
           path: |
@@ -364,7 +364,7 @@ jobs:
             echo "tag_flag=" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
@@ -413,7 +413,7 @@ jobs:
       # is named after its package (linux-x64-gnu, darwin-arm64, ...) so it lands
       # in packages/<name>/.
       - name: Download build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: packages
 
diff --git a/.github/workflows/windows-client.yml b/.github/workflows/windows-client.yml
index d01a1344..8a5272b2 100644
--- a/.github/workflows/windows-client.yml
+++ b/.github/workflows/windows-client.yml
@@ -45,7 +45,7 @@ jobs:
         run: make client PROFILE=${{ inputs.profile }} SPEECH=0 VERSION=0.0.0-check
 
       - name: Upload client
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: solidrt-go-windows-${{ inputs.profile }}
           path: |