diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 219ceef..ae24e46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,7 +57,7 @@ jobs:
       - name: Upload exact-source evidence
         id: exact_source_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true # Keep tests running; the final gate still fails on upload error.
         with:
           name: aether-exact-head-test-${{ matrix.os }}-${{ github.event.pull_request.head.sha || github.sha }}
@@ -125,7 +125,7 @@ jobs:
       - name: Upload ATS execution parity evidence
         id: parity_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true
         with:
           name: aether-ats-execution-parity-${{ matrix.os }}-${{ github.event.pull_request.head.sha || github.sha }}
@@ -298,7 +298,7 @@ jobs:
       - name: Upload exact-source evidence
         id: exact_source_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true
         with:
           name: aether-exact-head-supply-chain-${{ github.event.pull_request.head.sha || github.sha }}
@@ -365,7 +365,7 @@ jobs:
       - name: Upload dependency-audit evidence
         id: audit_upload
         if: ${{ always() && env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true
         with:
           name: aether-dependency-audit-${{ github.event.pull_request.head.sha || github.sha }}
@@ -399,7 +399,7 @@ jobs:
       - name: Upload SBOM
         id: sbom_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true
         with:
           name: aether-agents-sbom-${{ github.event.pull_request.head.sha || github.sha }}
@@ -440,7 +440,7 @@ jobs:
       - name: Upload exact-source evidence
         id: exact_source_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true
         with:
           name: aether-exact-head-pypi-launcher-${{ github.event.pull_request.head.sha || github.sha }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6cbb5b2..a51e077 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Upload exact-source evidence
         id: exact_source_upload
         if: ${{ env.AETHER_LOG_ONLY_RELEASE_PR != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: true # Finish analysis before failing on unavailable evidence.
         with:
           name: aether-exact-head-codeql-${{ github.event.pull_request.head.sha || github.sha }}
diff --git a/.github/workflows/npm-prepare.yml b/.github/workflows/npm-prepare.yml
index 7b2c782..77b1384 100644
--- a/.github/workflows/npm-prepare.yml
+++ b/.github/workflows/npm-prepare.yml
@@ -149,7 +149,7 @@ jobs:
         id: evidence_upload
         if: ${{ !inputs.manual_self_hosted_exception }}
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-preparation-${{ env.RELEASE_TAG }}-${{ github.sha }}
           path: |
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 6d359fb..7cd4da1 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -154,7 +154,7 @@ jobs:
           "$RUNNER_TEMP/launcher/bin/aether-agent" self --help > /dev/null
 
       - name: Upload release evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         continue-on-error: ${{ inputs.manual_self_hosted == true }}
         with:
           name: pypi-release-${{ env.RELEASE_TAG }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17466cf..0125dcc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -125,7 +125,7 @@ jobs:
           subject-path: ${{ steps.pack.outputs.tarball }}
 
       - name: Upload release evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-release-${{ env.RELEASE_TAG }}
           path: |