diff --git a/.github/workflows/g014-catalog-contract-baseline.yml b/.github/workflows/g014-catalog-contract-baseline.yml
index 338943134..1e13615a3 100644
--- a/.github/workflows/g014-catalog-contract-baseline.yml
+++ b/.github/workflows/g014-catalog-contract-baseline.yml
@@ -68,7 +68,7 @@ jobs:
           --output "$RUNNER_TEMP/g024-dual-clean-replay.json"
 
       - name: Upload dual clean replay evidence
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: g024-dual-clean-replay-${{ github.sha }}
           path: |
@@ -118,7 +118,7 @@ jobs:
           --validate-artifact artifacts/hosted-migration-ledger.json
 
       - name: Upload hosted migration-ledger artifact
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: hosted-migration-ledger-${{ github.sha }}
           path: artifacts/hosted-migration-ledger.json
diff --git a/.github/workflows/g014-historical-migration-ledger.yml b/.github/workflows/g014-historical-migration-ledger.yml
index 12c525fd9..364999b28 100644
--- a/.github/workflows/g014-historical-migration-ledger.yml
+++ b/.github/workflows/g014-historical-migration-ledger.yml
@@ -36,7 +36,7 @@ jobs:
         run: python backend/supabase/scripts/read_hosted_migration_ledger.py --validate-artifact artifacts/hosted-migration-ledger.json
 
       - name: Upload migration-ledger artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: hosted-migration-ledger
           path: artifacts/hosted-migration-ledger.json
diff --git a/.github/workflows/g034-hosted-migration-preflight.yml b/.github/workflows/g034-hosted-migration-preflight.yml
index cb0b528f2..456dd5af1 100644
--- a/.github/workflows/g034-hosted-migration-preflight.yml
+++ b/.github/workflows/g034-hosted-migration-preflight.yml
@@ -41,7 +41,7 @@ jobs:
           SUPABASE_DB_URL: ${{ secrets.SUPABASE_DB_URL }}
         run: python backend/supabase/scripts/preflight_g034_hosted_migration_closure.py --artifact g034-hosted-preflight.json
       - name: Upload sanitized bounded preflight artifact
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: g034-hosted-preflight-${{ github.sha }}
diff --git a/.github/workflows/g037-hosted-closure.yml b/.github/workflows/g037-hosted-closure.yml
index ab37c93d0..25e8e9f29 100644
--- a/.github/workflows/g037-hosted-closure.yml
+++ b/.github/workflows/g037-hosted-closure.yml
@@ -52,7 +52,7 @@ jobs:
           python backend/supabase/scripts/g037_hosted_closure_executor.py validate > "$RUNNER_TEMP/g037-receipts/validate-${GITHUB_SHA}.json"
       - name: Upload sanitized source-validation receipt
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: g037-hosted-closure-validate-${{ github.sha }}
           path: ${{ runner.temp }}/g037-receipts/validate-${{ github.sha }}.json
@@ -97,7 +97,7 @@ jobs:
           timeout --signal=TERM --kill-after=5s 120s python backend/supabase/scripts/g037_hosted_closure_executor.py "$REQUESTED_MODE" --db-env SUPABASE_DB_URL > "$RUNNER_TEMP/g037-receipts/${REQUESTED_MODE}-${GITHUB_SHA}.json"
       - name: Upload sanitized hosted receipt
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: g037-hosted-closure-${{ inputs.mode }}-${{ github.sha }}
           path: ${{ runner.temp }}/g037-receipts/${{ inputs.mode }}-${{ github.sha }}.json
diff --git a/.github/workflows/g038-account-deletion-successor.yml b/.github/workflows/g038-account-deletion-successor.yml
index aa412936e..23ef9ccf9 100644
--- a/.github/workflows/g038-account-deletion-successor.yml
+++ b/.github/workflows/g038-account-deletion-successor.yml
@@ -63,7 +63,7 @@ jobs:
         with:
           subject-path: ${{ runner.temp }}/g038-source-receipt/receipt.json
       - name: Upload authenticated source receipt and exact attestation bundle
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: g038-account-deletion-successor-source-receipt
           path: |
diff --git a/.github/workflows/g040-prefix-recovery.yml b/.github/workflows/g040-prefix-recovery.yml
index 0f17aba62..5d24f9add 100644
--- a/.github/workflows/g040-prefix-recovery.yml
+++ b/.github/workflows/g040-prefix-recovery.yml
@@ -76,7 +76,7 @@ jobs:
           PY
       - name: Upload bounded sanitized source receipt
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: g040-prefix-recovery-source-receipt
           path: ${{ runner.temp }}/g040-receipts/receipt.json
diff --git a/.github/workflows/nightly-local-regression.yml b/.github/workflows/nightly-local-regression.yml
index ca8bdb163..ddf3d2a96 100644
--- a/.github/workflows/nightly-local-regression.yml
+++ b/.github/workflows/nightly-local-regression.yml
@@ -254,7 +254,7 @@ jobs:
 
       - name: Upload sanitized local nightly artifacts
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
         with:
           name: nightly-local-${{ github.run_id }}
           path: nightly-artifacts/
diff --git a/.github/workflows/nightly-regression.yml b/.github/workflows/nightly-regression.yml
index b47b15d81..52c2df277 100644
--- a/.github/workflows/nightly-regression.yml
+++ b/.github/workflows/nightly-regression.yml
@@ -157,7 +157,7 @@ jobs:
           PY
       - name: Upload redacted unit diagnostics
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nightly-unit-diagnostics
           path: apps/web/nightly-artifacts/nightly-unit-redacted.log
@@ -270,7 +270,7 @@ jobs:
           PY
       - name: Upload redacted browser diagnostics
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nightly-playwright-diagnostics
           path: apps/web/nightly-artifacts/
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 66647be2e..e198eaf24 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -128,7 +128,7 @@ jobs:
           )
 
       - name: Upload bounded SBOM evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
         with:
           name: security-sbom-${{ github.event.pull_request.head.sha || github.sha }}
           path: |
diff --git a/.github/workflows/ts7-release-evidence.yml b/.github/workflows/ts7-release-evidence.yml
index df3a06c44..5482e8725 100644
--- a/.github/workflows/ts7-release-evidence.yml
+++ b/.github/workflows/ts7-release-evidence.yml
@@ -99,7 +99,7 @@ jobs:
       - id: upload
         name: Upload strictly validated final bundle only
         if: steps.verify-bundle-digest.outcome == 'success'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ts7-release-evidence-final-bundle
           path: |
diff --git a/.github/workflows/web-admin-ci.yml b/.github/workflows/web-admin-ci.yml
index aa80c7f7e..ea51622f9 100644
--- a/.github/workflows/web-admin-ci.yml
+++ b/.github/workflows/web-admin-ci.yml
@@ -156,7 +156,7 @@ jobs:
           )
       - name: Upload clean-install lock evidence
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
         with:
           name: dependency-modernization-lock-evidence-${{ github.run_id }}
           path: ${{ runner.temp }}/dependency-modernization-proof/**/dependency-modernization-lock-hashes-*.txt
@@ -203,7 +203,7 @@ jobs:
           REPORT="$RUNNER_TEMP/ts7-release/$tree/ubuntu-npm/report.json" TREE="$tree" node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="ubuntu-npm"||r.candidate?.platform!=="linux-x64"||r.candidate?.installer!=="npm"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
       - name: Upload npm benchmark evidence
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
         with:
           name: ts7-benchmark-ubuntu-npm-${{ github.run_id }}
           path: ${{ runner.temp }}/ts7-release
@@ -254,7 +254,7 @@ jobs:
           REPORT="$RUNNER_TEMP/ts7-release/$tree/ubuntu-bun/report.json" TREE="$tree" node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="ubuntu-bun"||r.candidate?.platform!=="linux-x64"||r.candidate?.installer!=="bun"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
       - name: Upload Bun benchmark evidence
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
         with:
           name: ts7-benchmark-ubuntu-bun-${{ github.run_id }}
           path: ${{ runner.temp }}/ts7-release
@@ -315,7 +315,7 @@ jobs:
           node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="windows-npm"||r.candidate?.platform!=="win32-x64"||r.candidate?.installer!=="npm"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
       - name: Upload npm benchmark evidence
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
         with:
           name: ts7-benchmark-windows-npm-${{ github.run_id }}
           path: ${{ runner.temp }}/ts7-release
@@ -369,7 +369,7 @@ jobs:
           node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="windows-bun"||r.candidate?.platform!=="win32-x64"||r.candidate?.installer!=="bun"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
       - name: Upload Bun benchmark evidence
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
         with:
           name: ts7-benchmark-windows-bun-${{ github.run_id }}
           path: ${{ runner.temp }}/ts7-release