diff --git a/.github/workflows/agent-review.yml b/.github/workflows/agent-review.yml
index a9976bd..996c1dd 100644
--- a/.github/workflows/agent-review.yml
+++ b/.github/workflows/agent-review.yml
@@ -52,7 +52,7 @@ jobs:
             > artifacts/copilot-agent-review.md
           rm artifacts/copilot-review-input.txt
       - name: Upload learned-rule report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agent-rule-report
           path: artifacts/
diff --git a/.github/workflows/agentic-rule-review.lock.yml b/.github/workflows/agentic-rule-review.lock.yml
index 326fd25..b7c7bee 100644
--- a/.github/workflows/agentic-rule-review.lock.yml
+++ b/.github/workflows/agentic-rule-review.lock.yml
@@ -341,7 +341,7 @@ jobs:
           cp -a "${RUNNER_TEMP}/gh-aw/aw-prompts/." /tmp/gh-aw/aw-prompts/
       - name: Upload activation artifact
         if: success() || failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: activation
           include-hidden-files: true
@@ -1058,7 +1058,7 @@ jobs:
       - name: Upload agent output fallback artifact
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agent-output-fallback
           path: |
@@ -1068,7 +1068,7 @@ jobs:
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agent
           path: |
@@ -1172,7 +1172,7 @@ jobs:
       - name: Upload usage artifact
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: usage
           path: |
@@ -1224,7 +1224,7 @@ jobs:
         id: upload-daily-aic-cache
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: aic-usage-cache
           path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
@@ -1607,7 +1607,7 @@ jobs:
           if [ -d /tmp/gh-aw/sandbox/firewall/audit ]; then mkdir -p /tmp/gh-aw/threat-detection/sandbox/firewall/audit && cp -r /tmp/gh-aw/sandbox/firewall/audit/. /tmp/gh-aw/threat-detection/sandbox/firewall/audit/; fi
       - name: Upload threat detection artifact
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: detection
           path: |
@@ -1747,7 +1747,7 @@ jobs:
             await main();
       - name: Upload Safe Outputs Items
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: safe-outputs-items
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f48ae17..1e88f72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,7 +69,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload validation evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: validation-evidence
           path: artifacts/
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index ffe030d..1f114b0 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -29,7 +29,7 @@ jobs:
           --report artifacts/cleanup-report.json
       - name: Upload cleanup report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: cleanup-report
           path: artifacts/cleanup-report.json
diff --git a/.github/workflows/self-healing-drill.yml b/.github/workflows/self-healing-drill.yml
index 7f92434..bde21d2 100644
--- a/.github/workflows/self-healing-drill.yml
+++ b/.github/workflows/self-healing-drill.yml
@@ -23,7 +23,7 @@ jobs:
           npm run self-healing:verify --
           --report artifacts/self-healing-proof.json
       - name: Upload proof-of-bug and proof-of-fix evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: self-healing-proof
           path: artifacts/self-healing-proof.json
diff --git a/.github/workflows/self-healing-rollback.yml b/.github/workflows/self-healing-rollback.yml
index 70e0b67..ef4bcd1 100644
--- a/.github/workflows/self-healing-rollback.yml
+++ b/.github/workflows/self-healing-rollback.yml
@@ -113,7 +113,7 @@ jobs:
             }' > rollback-artifacts/rollback-signal.json
       - name: Upload rollback evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rollback-signal-${{ github.event.workflow_run.id }}
           path: rollback-artifacts/
diff --git a/.github/workflows/self-healing.yml b/.github/workflows/self-healing.yml
index 8bcd717..ca8b8c2 100644
--- a/.github/workflows/self-healing.yml
+++ b/.github/workflows/self-healing.yml
@@ -93,7 +93,7 @@ jobs:
           fi
       - name: Upload containment evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: self-healing-signal-${{ github.event.workflow_run.id }}
           path: artifacts/
diff --git a/.github/workflows/validation-followup.yml b/.github/workflows/validation-followup.yml
index 12a777f..dfcc3bb 100644
--- a/.github/workflows/validation-followup.yml
+++ b/.github/workflows/validation-followup.yml
@@ -38,7 +38,7 @@ jobs:
             }' > artifacts/validation-workflow-run.json
           echo "conclusion=$CONCLUSION" >> "$GITHUB_OUTPUT"
       - name: Upload completion signal
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: validation-workflow-run-${{ github.event.workflow_run.id }}
           path: artifacts/validation-workflow-run.json