diff --git a/.github/workflows/contract-distribution.yml b/.github/workflows/contract-distribution.yml
index 685cf90..7da9c64 100644
--- a/.github/workflows/contract-distribution.yml
+++ b/.github/workflows/contract-distribution.yml
@@ -68,7 +68,7 @@ jobs:
           echo "audited_sha=$audited_sha" >> "$GITHUB_OUTPUT"
 
       - name: Upload candidate distribution artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: contract-distribution-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist/contract-distribution/
diff --git a/.github/workflows/release-readiness.yml b/.github/workflows/release-readiness.yml
index 2c1136d..49dcd26 100644
--- a/.github/workflows/release-readiness.yml
+++ b/.github/workflows/release-readiness.yml
@@ -217,7 +217,7 @@ jobs:
 
       - name: Upload release evidence bundle
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-evidence-${{ github.run_id }}-${{ github.run_attempt }}
           path: release-evidence/