diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8179cbc..1188a77 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -352,7 +352,7 @@ jobs:
         run: strip target/release/${{ matrix.artifact_name }}
         
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.asset_name }}
           path: target/release/${{ matrix.artifact_name }}
diff --git a/.github/workflows/harness.yml b/.github/workflows/harness.yml
index 8bda2f4..a56daca 100644
--- a/.github/workflows/harness.yml
+++ b/.github/workflows/harness.yml
@@ -28,7 +28,7 @@ jobs:
           toolchain: stable
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
       - run: cargo build --release --bin truent
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-bin
           path: target/release/truent
@@ -115,7 +115,7 @@ jobs:
           assert all(f["evidence"] == "proven" for f in d["findings"] if f["invariant_id"] == "evm_symbolic_counterexample")
           print("halmos ran:", d["stats"])
           PY
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: symbolic-report
           path: symbolic.json
@@ -181,7 +181,7 @@ jobs:
           print(f"mutation score: {caught}/{len(tested)} = {rate:.0%}")
           assert rate >= 0.60, "mutation score below the 60% floor — the tests do not catch enough injected bugs"
           PY
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: mutants
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 11c6b40..13743ff 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -161,7 +161,7 @@ jobs:
           fi
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binary-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/${{ steps.binary.outputs.name }}
@@ -274,7 +274,7 @@ jobs:
           fi
 
       - name: Upload npm package artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-package
           path: truent-npm-${{ needs.extract-version.outputs.version }}.tgz
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b74687..59ff7aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -205,7 +205,7 @@ jobs:
           echo "✓ Binary smoke test passed"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-x86_64-linux-gnu
           path: target/x86_64-unknown-linux-gnu/release/truent
@@ -249,7 +249,7 @@ jobs:
           echo "✓ Binary smoke test passed"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-x86_64-linux-musl
           path: target/x86_64-unknown-linux-musl/release/truent
@@ -293,7 +293,7 @@ jobs:
           echo "✓ Binary is aarch64 architecture"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-aarch64-linux-gnu
           path: target/aarch64-unknown-linux-gnu/release/truent
@@ -335,7 +335,7 @@ jobs:
           echo "✓ Binary smoke test passed"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-x86_64-apple-darwin
           path: target/x86_64-apple-darwin/release/truent
@@ -374,7 +374,7 @@ jobs:
           echo "✓ Binary smoke test passed"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-aarch64-apple-darwin
           path: target/aarch64-apple-darwin/release/truent
@@ -411,7 +411,7 @@ jobs:
         shell: pwsh
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: truent-x86_64-pc-windows-msvc
           path: target/x86_64-pc-windows-msvc/release/truent.exe
@@ -533,7 +533,7 @@ jobs:
           ls -lh dist/
 
       - name: Upload packaged artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: packages
           path: dist/
@@ -560,7 +560,7 @@ jobs:
           cat SHA256SUMS
 
       - name: Upload checksums
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: checksums
           path: dist/SHA256SUMS
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 2631a6d..00caa70 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -27,7 +27,7 @@ jobs:
         run: git clone --depth 1 https://github.com/rustsec/advisory-db.git /tmp/advdb
       - name: SBOM and dependency analysis
         run: ./target/release/truent deps . --advisory-db /tmp/advdb --sbom sbom.cdx.json --fail-on high
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom
           path: sbom.cdx.json
@@ -71,7 +71,7 @@ jobs:
           for i in $(seq 1 60); do curl -sf -o /dev/null http://127.0.0.1:3111/ && break; sleep 1; done
           ./target/release/truent probe http://127.0.0.1:3111 --authorized --ports none --format json --fail-on critical > probe-web.json
           ./target/release/truent probe http://127.0.0.1:3111 --authorized --ports none --fail-on critical || true
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: probe-web
           path: probe-web.json
@@ -109,7 +109,7 @@ jobs:
           if [ "${{ github.ref }}" = "refs/heads/main" ]; then STRICT=--strict; else STRICT=; fi
           ./target/release/truent release-check . --advisory-db /tmp/advdb --probe-report probe-web.json --symbolic-report symbolic.json --out release-check.md $STRICT
           head -60 release-check.md >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: release-check