diff --git a/.github/workflows/build-python-preview.yml b/.github/workflows/build-python-preview.yml
index e189b020d..dcf0a01f4 100644
--- a/.github/workflows/build-python-preview.yml
+++ b/.github/workflows/build-python-preview.yml
@@ -88,13 +88,13 @@ jobs:
           STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: python-preview-dist
           path: dist-preview/
 
       - name: Upload PR metadata
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: python-preview-metadata
           path: pr-metadata/
diff --git a/.github/workflows/dojo-e2e.yml b/.github/workflows/dojo-e2e.yml
index 38e2a2ddc..853411fd4 100644
--- a/.github/workflows/dojo-e2e.yml
+++ b/.github/workflows/dojo-e2e.yml
@@ -324,7 +324,7 @@ jobs:
 
       - name: Upload traces – ${{ matrix.suite }}
         if: always() # Uploads artifacts even if tests fail
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ matrix.suite }}-playwright-traces
           path: |
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 7d586f37f..d4db8b967 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -167,7 +167,7 @@ jobs:
 
       - name: Upload TypeScript build artifacts
         if: steps.ts.outputs.count != '0'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ts-canary-artifacts
           path: |
@@ -196,7 +196,7 @@ jobs:
 
       - name: Upload Python build artifacts
         if: steps.py.outputs.has_packages == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: py-canary-artifacts
           path: |
@@ -205,7 +205,7 @@ jobs:
           retention-days: 1
 
       - name: Upload bump result
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: bump-result
           path: /tmp/bump-result.json
diff --git a/.github/workflows/publish-commit.yml b/.github/workflows/publish-commit.yml
index 8022b5925..f85ff295a 100644
--- a/.github/workflows/publish-commit.yml
+++ b/.github/workflows/publish-commit.yml
@@ -39,7 +39,7 @@ jobs:
         run: pnpm run build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: pkg-pr-new-build
           path: |
diff --git a/.github/workflows/publish-kotlin-sdk.yml b/.github/workflows/publish-kotlin-sdk.yml
index 19c090be2..a53b441c6 100644
--- a/.github/workflows/publish-kotlin-sdk.yml
+++ b/.github/workflows/publish-kotlin-sdk.yml
@@ -111,7 +111,7 @@ jobs:
       # JReleaser's publish.sh does a Gradle build internally, so we upload
       # the Gradle caches to speed up the publish job's rebuild.
       - name: Upload Gradle build cache
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: kotlin-gradle-cache
           path: |
@@ -187,7 +187,7 @@ jobs:
 
       - name: Upload JReleaser logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: jreleaser-logs
           path: sdks/community/kotlin/library/build/jreleaser/
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 149b91c6d..e7cd7f92d 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -198,7 +198,7 @@ jobs:
 
       - name: Upload TypeScript build artifacts
         if: steps.detect_ts.outputs.count != '0'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ts-build-artifacts
           path: |
@@ -228,7 +228,7 @@ jobs:
 
       - name: Upload Python build artifacts
         if: steps.detect_py.outputs.count != '0'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: py-build-artifacts
           path: |