diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8089eea7..0b5bc53d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,7 +191,7 @@ jobs:
       # assets. wheel-artifact.yml re-publishes it under the same name on a
       # schedule so the 90-day artifact expiry does not strand users.
       - name: Upload wheel as a workflow artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-hwpx-wheel
           path: |
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b34bd38b..3d896696 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload pytest summary log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pytest-summary-${{ matrix.python-version }}
           path: pytest-summary.log
diff --git a/.github/workflows/wheel-artifact.yml b/.github/workflows/wheel-artifact.yml
index 0e835c33..b29da6e9 100644
--- a/.github/workflows/wheel-artifact.yml
+++ b/.github/workflows/wheel-artifact.yml
@@ -47,7 +47,7 @@ jobs:
           ls -l
 
       - name: Upload as the stable artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-hwpx-wheel
           path: |
diff --git a/tests/test_release_workflow_safety.py b/tests/test_release_workflow_safety.py
index f35ae82c..6b1f19d6 100644
--- a/tests/test_release_workflow_safety.py
+++ b/tests/test_release_workflow_safety.py
@@ -139,7 +139,7 @@
         # Release assets (see wheel-artifact.yml). Upload-only: it reads
         # dist/ and the checksum manifest and mutates nothing.
         "Upload wheel as a workflow artifact",
-        "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
+        "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9",
         False,
         {
             "name": "python-hwpx-wheel",