diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e4e97b..b3dc69a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Upload desktop browser report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: desktop-browser-report
           path: |
@@ -156,7 +156,7 @@ jobs:
       - name: Exercise atomic sidecar installation
         run: python sidecars/mitmproxy/install_sidecar_bundle.py sidecars/mitmproxy/dist ${{ runner.temp }}/codeischeap-sidecar
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sidecar-bundle-${{ runner.os }}-${{ runner.arch }}
           path: sidecars/mitmproxy/dist/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ba5a378..ff2d2c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -274,7 +274,7 @@ jobs:
           printf 'path=%s\n' "$staging" >> "$GITHUB_OUTPUT"
 
       - name: Upload signed release artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-${{ steps.platform.outputs.key || steps.mac_platform.outputs.key }}
           path: ${{ steps.platform.outputs.path || steps.mac_platform.outputs.path }}/*