diff --git a/.github/workflows/ci-adversarial.yml b/.github/workflows/ci-adversarial.yml
index 6af2a4d11..0e0c87c65 100644
--- a/.github/workflows/ci-adversarial.yml
+++ b/.github/workflows/ci-adversarial.yml
@@ -37,7 +37,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- adversarial
       - name: Upload adversarial artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-adversarial
           path: ci-reports/
diff --git a/.github/workflows/ci-attestation.yml b/.github/workflows/ci-attestation.yml
index c4d666928..16e71939d 100644
--- a/.github/workflows/ci-attestation.yml
+++ b/.github/workflows/ci-attestation.yml
@@ -50,7 +50,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- attest
       - name: Upload attestation
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-attestation
           path: ci-reports/attest/
diff --git a/.github/workflows/ci-benchmark.yml b/.github/workflows/ci-benchmark.yml
index c95c9d6c1..4597546b2 100644
--- a/.github/workflows/ci-benchmark.yml
+++ b/.github/workflows/ci-benchmark.yml
@@ -137,7 +137,7 @@ jobs:
           make nonos-mk-bench
       - name: Upload benchmark artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: nonos-benchmarks-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ inputs['output-root'] }}/${{ github.run_id }}-${{ github.run_attempt }}/
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index a43965297..36d9883da 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -65,7 +65,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- build
       - name: Upload build artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-build
           path: ci-reports/
diff --git a/.github/workflows/ci-evidence.yml b/.github/workflows/ci-evidence.yml
index 74adce763..8ee592a13 100644
--- a/.github/workflows/ci-evidence.yml
+++ b/.github/workflows/ci-evidence.yml
@@ -32,7 +32,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- evidence
       - name: Upload evidence artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-evidence
           path: ci-reports/
diff --git a/.github/workflows/ci-iso.yml b/.github/workflows/ci-iso.yml
index d4ff5a33d..bc74d4fe2 100644
--- a/.github/workflows/ci-iso.yml
+++ b/.github/workflows/ci-iso.yml
@@ -115,7 +115,7 @@ jobs:
           cat target/iso/attestation-manifest.txt
 
       - name: Upload the ISO and manifest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: nonos-production-iso
           path: |
diff --git a/.github/workflows/ci-release-artifacts.yml b/.github/workflows/ci-release-artifacts.yml
index cdcf227ae..45c0636a9 100644
--- a/.github/workflows/ci-release-artifacts.yml
+++ b/.github/workflows/ci-release-artifacts.yml
@@ -90,7 +90,7 @@ jobs:
           ZK_BOOT_NONCE_SEED: ${{ secrets.ZK_BOOT_NONCE_SEED }}
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- release
       - name: Upload the bootable image
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: nonos-image
           path: release/
@@ -99,7 +99,7 @@ jobs:
 
       - name: Upload release artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-release
           path: ci-reports/
diff --git a/.github/workflows/ci-reproducible.yml b/.github/workflows/ci-reproducible.yml
index da5a23520..2ebd6ea4d 100644
--- a/.github/workflows/ci-reproducible.yml
+++ b/.github/workflows/ci-reproducible.yml
@@ -84,7 +84,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- reproducible
       - name: Upload reproducibility artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-reproducible
           path: ci-reports/
diff --git a/.github/workflows/ci-runtime.yml b/.github/workflows/ci-runtime.yml
index 47df061c3..bc26ae5d9 100644
--- a/.github/workflows/ci-runtime.yml
+++ b/.github/workflows/ci-runtime.yml
@@ -88,7 +88,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- runtime
       - name: Upload runtime artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-runtime
           path: ci-reports/
diff --git a/.github/workflows/ci-supply-chain.yml b/.github/workflows/ci-supply-chain.yml
index 1a992090d..03267047a 100644
--- a/.github/workflows/ci-supply-chain.yml
+++ b/.github/workflows/ci-supply-chain.yml
@@ -37,7 +37,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- supply-chain
       - name: Upload supply-chain artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-supply-chain
           path: ci-reports/
diff --git a/.github/workflows/ci-trust-chain.yml b/.github/workflows/ci-trust-chain.yml
index 644856294..eec8d4221 100644
--- a/.github/workflows/ci-trust-chain.yml
+++ b/.github/workflows/ci-trust-chain.yml
@@ -36,7 +36,7 @@ jobs:
         run: cargo run --release --manifest-path nonos-verify/Cargo.toml -- trust-chain
       - name: Upload trust-chain artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: ci-reports-trust-chain
           path: ci-reports/
diff --git a/.github/workflows/lean.yml b/.github/workflows/lean.yml
index cb90fabbd..1ae774592 100644
--- a/.github/workflows/lean.yml
+++ b/.github/workflows/lean.yml
@@ -100,7 +100,7 @@ jobs:
           cat "$EV/manifest.json"
       - name: Upload lean evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: lean-proofs-${{ github.run_id }}-${{ github.run_attempt }}
           path: lean-evidence/
diff --git a/.github/workflows/submodule-sync.yml b/.github/workflows/submodule-sync.yml
index fc69c99fd..bfe860fb8 100644
--- a/.github/workflows/submodule-sync.yml
+++ b/.github/workflows/submodule-sync.yml
@@ -92,7 +92,7 @@ jobs:
 
       - name: Upload verification reports
         if: always() && steps.diff.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: submodule-sync-${{ github.run_id }}
           path: ci-reports/
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 21d826b2f..2e2186418 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -60,7 +60,7 @@ jobs:
             || { echo "::error::a sorry is present in the Lean corpus"; exit 1; }
       - name: Publish evidence manifest
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: verification-evidence
           path: verification/evidence/EVIDENCE.json