diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60dd5e6..0006bcb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -775,7 +775,7 @@ jobs:
       # visible as a red tick.
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-artifacts
           path: fuzz/artifacts/
@@ -982,7 +982,7 @@ jobs:
         run: python ci/artifact-bytes.py --without nist-sp-800-53Ar5 --without nist-sp-800-161r1 > "digests-${{ matrix.os }}.sha256"
 
       # `overwrite`, so re-running every job does not fail on the name the first attempt uploaded.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digests-${{ matrix.os }}
           path: digests-${{ matrix.os }}.sha256
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index a804dd7..8b04410 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -212,7 +212,7 @@ jobs:
       # Everything the script wrote: the tarball, the fingerprint of the binary inside it, this
       # runner's own SHA256SUMS.txt and the build log. `verify` consumes the first three.
       # `overwrite`, so re-running a leg does not fail on the name the first attempt uploaded.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: built-${{ matrix.target }}
           path: target/release-artifacts/
@@ -250,7 +250,7 @@ jobs:
       # then the `gh release create` line in docs/RELEASING.md §8 over dist/*.tar.gz and
       # dist/SHA256SUMS.txt. The fingerprints ride along so a locally built binary can be held to
       # the runners' bytes with `ci/release-artifacts.sh --fingerprint-only` and `diff`.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-bundle
           path: |