diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml
index 88b4684..bf112e9 100644
--- a/.github/workflows/checkout-operation-lock-canary.yml
+++ b/.github/workflows/checkout-operation-lock-canary.yml
@@ -256,7 +256,7 @@ jobs:
 
       - name: Upload bounded checkout-lock evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: checkout-operation-lock-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 181441d..71ea877 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
       - run: python -m pip install -e '.[test]'
       - run: pytest -q
       - run: python scripts/readiness.py --offline
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: readiness-${{ github.run_id }}
diff --git a/.github/workflows/live.yml b/.github/workflows/live.yml
index afcb11c..fa23001 100644
--- a/.github/workflows/live.yml
+++ b/.github/workflows/live.yml
@@ -33,7 +33,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: ./scripts/run-live.sh
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: live-evidence-${{ github.run_id }}