diff --git a/.github/workflows/doofus-external-trial-stage.yml b/.github/workflows/doofus-external-trial-stage.yml
index 03e66e5..f2ff622 100644
--- a/.github/workflows/doofus-external-trial-stage.yml
+++ b/.github/workflows/doofus-external-trial-stage.yml
@@ -92,7 +92,7 @@ jobs:
             --downloaded-asset "$downloaded"
 
       - name: Upload exact canonical request artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: doofus-external-trial-request-v1
           path: ${{ runner.temp }}/doofus-stage/doofus-external-trial-request.json
diff --git a/.github/workflows/doofus-external-trial.yml b/.github/workflows/doofus-external-trial.yml
index 8367545..59a3714 100644
--- a/.github/workflows/doofus-external-trial.yml
+++ b/.github/workflows/doofus-external-trial.yml
@@ -374,7 +374,7 @@ jobs:
           echo "receipt_artifact_name=$name" >> "$GITHUB_OUTPUT"
 
       - name: Upload durable public-safe receipt subjects
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.names.outputs.receipt_artifact_name }}
           path: ${{ runner.temp }}/doofus-trial-output/public
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index ec03616..d528eaf 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -144,7 +144,7 @@ jobs:
         # supplied: path" -- which lands last in the log and buries the real
         # error. Guard on the variable so an early failure reports itself.
         if: failure() && env.DUMBMONEY_NATIVE_SMOKE_FAILURE_GLOB != ''
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dumbmoney-native-smoke-failure-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ env.DUMBMONEY_NATIVE_SMOKE_FAILURE_GLOB }}
@@ -340,7 +340,7 @@ jobs:
             ${{ env.DUMBMONEY_PUBLIC_SETUP }}
             ${{ env.DUMBMONEY_PUBLIC_MANIFEST }}
       - name: Upload only protected public release payload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dumbmoney-windows-protected-setup-${{ github.sha }}
           path: |
diff --git a/tests/test_doofus_external_trial_stage_workflow.py b/tests/test_doofus_external_trial_stage_workflow.py
index 1d0e6df..6759d41 100644
--- a/tests/test_doofus_external_trial_stage_workflow.py
+++ b/tests/test_doofus_external_trial_stage_workflow.py
@@ -63,7 +63,7 @@ def test_stage_workflow_upload_is_exact_short_lived_and_commit_pinned() -> None:
         in uses
     )
     assert (
-        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+        "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
         in uses
     )
     assert "name: doofus-external-trial-request-v1" in text
diff --git a/tests/test_doofus_external_trial_workflow.py b/tests/test_doofus_external_trial_workflow.py
index 055c95c..6fc199e 100644
--- a/tests/test_doofus_external_trial_workflow.py
+++ b/tests/test_doofus_external_trial_workflow.py
@@ -55,7 +55,7 @@ def test_workflow_actions_are_commit_pinned_and_permissions_are_minimal() -> Non
         in uses
     )
     assert (
-        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+        "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
         in uses
     )
     assert (