diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d6f3b5..68b1aee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,7 +92,7 @@ jobs:
         run: php tools/check-coverage.php build/coverage/summary.txt 100
       - name: Upload fresh coverage evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-evidence
           path: |
@@ -133,7 +133,7 @@ jobs:
         run: cat build/mutation/summary.log
       - name: Upload mutation evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutation-evidence
           path: build/mutation/
@@ -194,7 +194,7 @@ jobs:
       - name: Inspect distribution contents
         run: php tools/check-release-archive.php build/dist/fleetbase-php-dev.tar.gz
       - name: Upload inspected source archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: distribution-archive
           path: build/dist/fleetbase-php-dev.tar.gz
@@ -254,7 +254,7 @@ jobs:
           cd build/release-candidate
           sha256sum fleetbase-php-* > SHA256SUMS
       - name: Upload complete release candidate
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleetbase-php-release-candidate
           path: build/release-candidate/
diff --git a/.github/workflows/contract-drift.yml b/.github/workflows/contract-drift.yml
index 24efb8b..3d1d4ae 100644
--- a/.github/workflows/contract-drift.yml
+++ b/.github/workflows/contract-drift.yml
@@ -58,7 +58,7 @@ jobs:
           fi
       - name: Upload drift evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: contract-drift
           path: |
diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml
index 860b8d6..7d72c42 100644
--- a/.github/workflows/contract.yml
+++ b/.github/workflows/contract.yml
@@ -260,7 +260,7 @@ jobs:
           FLEETBASE_CONTRACT_BASE_URL: http://localhost:8000
       - name: Upload SDK live-contract evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: php-sdk-live-contract
           path: .sdk/build/live-contract/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f5def47..2b63c02 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -96,7 +96,7 @@ jobs:
           cd build/dist
           sha256sum fleetbase-php-* > SHA256SUMS
       - name: Upload release-candidate artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleetbase-php-${{ needs.prepare.outputs.version }}-release-candidate
           path: build/dist/
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 57750ec..f2f8e3f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -101,7 +101,7 @@ jobs:
       - name: Enforce clean CodeQL findings
         run: php tools/check-sarif.php build/codeql/actions.sarif
       - name: Upload CodeQL evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codeql-actions-sarif
           path: build/codeql/actions.sarif