diff --git a/.github/workflows/android-managed-device-retry.yml b/.github/workflows/android-managed-device-retry.yml
index 528b7e5dd..f0acde088 100644
--- a/.github/workflows/android-managed-device-retry.yml
+++ b/.github/workflows/android-managed-device-retry.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Download retry marker
         if: steps.artifact.outputs.found == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ steps.artifact.outputs.name }}
           path: ${{ runner.temp }}/android-managed-device-retry
diff --git a/.github/workflows/android-managed-device.yml b/.github/workflows/android-managed-device.yml
index 5cfd3b6cf..ecd084efb 100644
--- a/.github/workflows/android-managed-device.yml
+++ b/.github/workflows/android-managed-device.yml
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload generated Baseline Profile and full log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: baseline-profile-${{ github.sha }}-${{ github.run_id }}
           if-no-files-found: warn
@@ -884,7 +884,7 @@ jobs:
         if: >-
           always() &&
           steps.infrastructure_failure.outputs.retryable == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-managed-device-retry-${{ matrix.device }}-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: error
@@ -894,7 +894,7 @@ jobs:
 
       - name: Upload androidTest reports and failure evidence
         if: always() && steps.target.outputs.run_lane == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-managed-device-${{ matrix.artifact }}-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: warn
diff --git a/.github/workflows/api-contract-smoke.yml b/.github/workflows/api-contract-smoke.yml
index fa343bae0..c4d80e72a 100644
--- a/.github/workflows/api-contract-smoke.yml
+++ b/.github/workflows/api-contract-smoke.yml
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload failure reports
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-wire-contract-reports-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: warn
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fabfb0def..64636a646 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -136,14 +136,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: actions
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:actions
 
@@ -173,14 +173,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: javascript-typescript
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:javascript-typescript
 
@@ -230,7 +230,7 @@ jobs:
         uses: ./.github/actions/setup-ci-config
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: java-kotlin
           build-mode: manual
@@ -258,7 +258,7 @@ jobs:
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:java-kotlin
 
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 5ab84d9c0..df75655f3 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload machine-readable audit evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-dependency-audit
           path: ${{ env.REPORT_DIR }}
diff --git a/.github/workflows/qa-distribution-decision.yml b/.github/workflows/qa-distribution-decision.yml
index abf95fc5e..e0191f60e 100644
--- a/.github/workflows/qa-distribution-decision.yml
+++ b/.github/workflows/qa-distribution-decision.yml
@@ -47,7 +47,7 @@ jobs:
 
       - name: Upload decision and evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: qa-distribution-decision
           path: ${{ runner.temp }}/qa-distribution-decision
diff --git a/.github/workflows/release-aab-preflight.yml b/.github/workflows/release-aab-preflight.yml
index d6b83fb31..cfc688ba2 100644
--- a/.github/workflows/release-aab-preflight.yml
+++ b/.github/workflows/release-aab-preflight.yml
@@ -144,7 +144,7 @@ jobs:
             "$AFTERNOTE_CI_RELEASE_KEY_PASSWORD_FILE"
 
       - name: Upload digest and size reports only
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-aab-preflight-report
           if-no-files-found: error
diff --git a/.github/workflows/screenshot-baseline-apply.yml b/.github/workflows/screenshot-baseline-apply.yml
index da2f965d8..2a538feb3 100644
--- a/.github/workflows/screenshot-baseline-apply.yml
+++ b/.github/workflows/screenshot-baseline-apply.yml
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Download PNG artifact from triggering run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: screenshot-baseline-artifact
           path: ${{ runner.temp }}/screenshot-baseline
diff --git a/.github/workflows/screenshot-baseline-generate.yml b/.github/workflows/screenshot-baseline-generate.yml
index 3ba4977c7..6d3d92b22 100644
--- a/.github/workflows/screenshot-baseline-generate.yml
+++ b/.github/workflows/screenshot-baseline-generate.yml
@@ -218,7 +218,7 @@ jobs:
           git diff --cached --name-status
 
       - name: Upload baseline blobs for privileged validation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: screenshot-baseline-artifact
           path: ${{ runner.temp }}/screenshot-baseline/
diff --git a/.github/workflows/screenshot.yml b/.github/workflows/screenshot.yml
index 5c283c4fa..0183b3ea2 100644
--- a/.github/workflows/screenshot.yml
+++ b/.github/workflows/screenshot.yml
@@ -152,7 +152,7 @@ jobs:
       # 실패 시 diff/rendered 이미지를 artifact 로 업로드 — 본인이 다운로드해 시각 차이 확인 가능
       - name: Upload screenshot diff on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: screenshot-test-results
           path: ${{ steps.screenshot-paths.outputs.list }}
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index be742ad23..a5d633b7c 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -151,7 +151,7 @@ jobs:
       - name: Upload Kover coverage reports
         id: kover-artifact
         if: contains(inputs.gradle_tasks, 'kover')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: kover-jvm-coverage
           path: |
@@ -182,7 +182,7 @@ jobs:
       # 실패한 테스트의 HTML/XML 리포트를 PR artifact 로 보존 — CI 로그에서 stack trace 추적이 빠름.
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: unit-test-reports
           path: |