diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 4c272fc..e38171f 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -202,7 +202,7 @@ jobs:
           printf 'artifact_name=%s\npackage_version=%s\ntarball_name=%s\n' \
             "$artifact_name" "$package_version" "$tarball_name" >> "$GITHUB_OUTPUT"
       - name: Upload reviewed npm artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           if-no-files-found: error
           name: ${{ steps.artifact.outputs.artifact_name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5cd055c..d8edde7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -140,7 +140,7 @@ jobs:
           printf 'archive_name=%s\n' "$archive_name" >> "$GITHUB_OUTPUT"
       - name: Upload verified canonical artifact
         id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: direct-release-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/direct-release
@@ -234,7 +234,7 @@ jobs:
           node "$RUNNER_TEMP/github-release.ts" verify "$RUNNER_TEMP/direct-release"
       - name: Upload attested canonical artifact
         id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: direct-attested-release-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/direct-release