diff --git a/.github/workflows/python-sdk.yml b/.github/workflows/python-sdk.yml
index 434ab713b..fd7a47801 100644
--- a/.github/workflows/python-sdk.yml
+++ b/.github/workflows/python-sdk.yml
@@ -68,7 +68,7 @@ jobs:
           "$venv/bin/python" -m pytest -q "$GITHUB_WORKSPACE/crates/nokv-python/tests"
 
       - name: Upload wheel for inspection
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: nokv-python-sdk-${{ github.sha }}-linux-x86_64
           path: dist/*.whl
diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml
index b4bc220be..943c925de 100644
--- a/.github/workflows/release-homebrew.yml
+++ b/.github/workflows/release-homebrew.yml
@@ -98,7 +98,7 @@ jobs:
             --marker "$RELEASE_DIR/.nokv-tap.json"
 
       - name: Upload exact release candidate
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: nokv-homebrew-${{ needs.validate.outputs.commit }}
           path: ${{ runner.temp }}/nokv-homebrew-release
diff --git a/.github/workflows/release-python-sdk.yml b/.github/workflows/release-python-sdk.yml
index 7d43e0d7a..36b1d9993 100644
--- a/.github/workflows/release-python-sdk.yml
+++ b/.github/workflows/release-python-sdk.yml
@@ -149,7 +149,7 @@ jobs:
           "$venv/bin/python" -m pytest -q "$GITHUB_WORKSPACE/crates/nokv-python/tests"
 
       - name: Upload wheel
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: nokv-python-sdk-${{ needs.validate.outputs.commit }}-${{ matrix.name }}
           path: dist/*.whl
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 090dd710e..4e5a65928 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -128,7 +128,7 @@ jobs:
 
       - name: Upload source-bound qualification product
         id: qualification_product
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: phase1-product-${{ github.sha }}
           path: target/phase1-qualification/debug/nokv
@@ -326,7 +326,7 @@ jobs:
 
       - name: Upload Phase 1 qualification evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: phase1-qualification-${{ github.sha }}
           path: ${{ runner.temp }}/phase1-qualification
@@ -468,7 +468,7 @@ jobs:
 
       - name: Upload local-WAL recovery evidence
         if: ${{ always() && steps.local_wal_recovery.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: local-wal-recovery-${{ github.sha }}
           path: ${{ runner.temp }}/local-wal-recovery-evidence
@@ -538,7 +538,7 @@ jobs:
 
       - name: Upload live Workbench evidence
         if: ${{ always() && steps.live_workbench.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: live-workbench-${{ github.sha }}
           path: ${{ runner.temp }}/live-workbench
@@ -569,7 +569,7 @@ jobs:
 
       - name: Upload restore composition evidence
         if: ${{ always() && steps.restore_composition.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: restore-composition-${{ github.sha }}
           path: ${{ runner.temp }}/restore-composition/evidence
@@ -659,7 +659,7 @@ jobs:
 
       - name: Upload object namespace recovery evidence
         if: ${{ always() && steps.object_namespace_recovery.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: object-namespace-recovery-${{ github.sha }}
           path: ${{ runner.temp }}/object-namespace-recovery-evidence
@@ -743,7 +743,7 @@ jobs:
 
       - name: Upload fork restore recovery evidence
         if: ${{ always() && steps.fork_restore_recovery.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: fork-restore-recovery-${{ github.sha }}
           path: ${{ runner.temp }}/fork-restore-recovery-evidence