diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 99aa73a4..57f2102b 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -93,7 +93,7 @@ jobs:
           # Smoke the exact renamed binary that is included in the uploaded archive.
           uv run python scripts/smoke_release.py "$BINARY_PATH" "$VERSION"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: strix-${{ matrix.target }}
           path: |
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload signed verification bundle
         if: ${{ github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signed-release-verification
           path: release/*
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f8e2352..ab7893d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,7 +194,7 @@ jobs:
 
       - name: Upload release diagnostics
         if: failure() && steps.changed_paths.outputs.docs_only != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engine-ci-diagnostics-${{ github.run_id }}
           path: |