diff --git a/.github/workflows/ai-provider-matrix.yml b/.github/workflows/ai-provider-matrix.yml
index 40055894..8ad11eac 100644
--- a/.github/workflows/ai-provider-matrix.yml
+++ b/.github/workflows/ai-provider-matrix.yml
@@ -85,7 +85,7 @@ jobs:
 
       - name: Upload provider scorecard
         if: always() && steps.gate.outputs.enabled == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: ai-provider-matrix-${{ matrix.provider }}
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aad9cf88..76d753f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -242,7 +242,7 @@ jobs:
       # `coverage-and-audit` job's own artifact instead.
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: test-results-py${{ matrix.python-version }}
           path: junit.xml
@@ -369,7 +369,7 @@ jobs:
       # artifact names fail under upload-artifact v4+.
       - name: Upload coverage results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: coverage-results-py3.12
           path: |
diff --git a/.github/workflows/integration-emulated-heavy.yml b/.github/workflows/integration-emulated-heavy.yml
index b4a33181..768c9a16 100644
--- a/.github/workflows/integration-emulated-heavy.yml
+++ b/.github/workflows/integration-emulated-heavy.yml
@@ -452,7 +452,7 @@ jobs:
 
       - name: Upload JUnit + compose logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: lakekeeper-integration-logs
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52c16f19..dac02c8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -312,14 +312,14 @@ jobs:
             --of JSON --output-file sbom.cdx.json
 
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: sbom
           path: sbom.cdx.json
           retention-days: 30
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: dist
           path: dist/
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cb6f16b0..fcce6a09 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -39,7 +39,7 @@ jobs:
           publish_results: true
 
       - name: Upload Scorecard artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: scorecard-results
           path: results.sarif