diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7ec29b5..a3ea683 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -37,7 +37,7 @@ jobs:
           set -euo pipefail
           cargo llvm-cov --locked --lcov --output-path lcov.info
           cargo llvm-cov report --summary-only | tee -a "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lcov
           path: lcov.info
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ba7cf86..c2698c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,7 +51,7 @@ jobs:
           cargo cyclonedx --format json --spec-version 1.5 --override-filename wraith-linux-x86_64.cdx
           mv wraith-linux-x86_64.cdx.json target/dist/
           jq -e '.bomFormat == "CycloneDX" and (.components | length > 0)' target/dist/wraith-linux-x86_64.cdx.json >/dev/null
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wraith-linux-x86_64
           path: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ed026f5..1efa362 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -28,7 +28,7 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scorecard-sarif
           path: results.sarif