diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee3630d..af7aacd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,7 +68,7 @@ jobs:
               sys.exit(1)
           print(f"pip-audit: 0 CRITICAL — gate passed.")
           EOF
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pip-audit-report
@@ -100,7 +100,7 @@ jobs:
             exit 1
           fi
           echo "bandit: no HIGH/CRITICAL issues."
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: bandit-report
@@ -170,7 +170,7 @@ jobs:
             --cov-report=xml:coverage.xml \
             --cov-report=term-missing \
             --cov-fail-under=70
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-unit
@@ -217,7 +217,7 @@ jobs:
         env:
           REDIS_URL: redis://localhost:6379/0
           DATABASE_URL: postgresql://fraud:local_dev_only@localhost/fraud_detection
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-integration