diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 4498ca5..5d3394d 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -60,7 +60,7 @@ jobs:
 
       # A release ships neither config, and Plugin Check flags scoper.inc.php's missing direct-access guard.
       - name: Upload the build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: consumer-a
           path: |
diff --git a/tests/Integration/Support/admin-request.php b/tests/Integration/Support/admin-request.php
index 4617ecf..09c2c27 100644
--- a/tests/Integration/Support/admin-request.php
+++ b/tests/Integration/Support/admin-request.php
@@ -103,11 +103,11 @@ static function ( int $level, string $message, string $file, int $line ) use ( &
 	'accepted_args' => 0,
 );
 
-// WordPress's update checks give WordPress.org a few seconds and warn when it answers late, which would fail the request's test, so they read an answer with no updates.
+// WordPress's update checks give WordPress.org a few seconds and warn when it answers late, which would fail the request's test, so they read an answer listing no updates, with every key wp_update_themes() reads unguarded.
 $wp_filter['pre_http_request'][10][] = array( // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Hooks the request before WordPress loads.
 	'function'      => static fn ( mixed $response, array $args, string $url ): mixed => 1 === preg_match( '#^https?://api\.wordpress\.org/(core/version-check|plugins/update-check|themes/update-check)/#', $url ) ? array(
 		'headers'  => array(),
-		'body'     => '{}',
+		'body'     => '{"plugins":[],"themes":[],"no_update":[],"translations":[]}',
 		'response' => array(
 			'code'    => 200,
 			'message' => 'OK',