diff --git a/.github/workflows/actions-smoke.yml b/.github/workflows/actions-smoke.yml
index 221c77d..b22bbe7 100644
--- a/.github/workflows/actions-smoke.yml
+++ b/.github/workflows/actions-smoke.yml
@@ -36,7 +36,7 @@ jobs:
           echo "generation-1" > out/payload.txt
 
       - name: Upload (first)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: smoke-artifact
           path: out/payload.txt
@@ -50,7 +50,7 @@ jobs:
         run: echo "generation-2" > out/payload.txt
 
       - name: Upload (overwrite)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: smoke-artifact
           path: out/payload.txt
diff --git a/.github/workflows/deskjig-tests.yml b/.github/workflows/deskjig-tests.yml
index 8849076..ecee0fd 100644
--- a/.github/workflows/deskjig-tests.yml
+++ b/.github/workflows/deskjig-tests.yml
@@ -275,7 +275,7 @@ jobs:
 
       - name: Upload test log on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: deskjig-tests-headless-log
           path: build/deskjig-tests.headless.log
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f43cd04..f05074d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -456,7 +456,7 @@ jobs:
           cp "$MATCHES" "$RUNNER_TEMP/stage-tools/sign_update"
 
       - name: Upload app artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: deskjig-app
           path: ${{ runner.temp }}/stage/DeskJig.app.zip
@@ -465,7 +465,7 @@ jobs:
           overwrite: true
 
       - name: Upload Sparkle sign_update artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sparkle-sign-update
           path: ${{ runner.temp }}/stage-tools/sign_update
@@ -485,7 +485,7 @@ jobs:
 
       - name: Upload build log on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: deskjig-release-build-log
           path: build/deskjig-build.app.log
@@ -649,7 +649,7 @@ jobs:
       # A DMG is a flat, signature-embedded file — it crosses the artifact
       # boundary as-is, no ditto zip needed (publish still re-verifies it).
       - name: Upload DMG artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: deskjig-dmg
           path: ${{ runner.temp }}/dist/DeskJig-${{ needs.gate.outputs.version }}.dmg