diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 966f1ec0..cfb1d5ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,7 @@ jobs:
         run: uv run wardline scan src/ --format sarif --output results.sarif --fail-on ERROR
       - name: Preserve SARIF for trusted upload
         if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: self-hosting-sarif
           path: results.sarif
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 11feadeb..36ed6ec3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
         run: |
           cd dist
           sha256sum * > SHA256SUMS
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist/