diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 87e8110..6a54d2f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -106,7 +106,7 @@ jobs:
             sha256sum release.env >> artifact.sha256
           )
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: verified-pypi-package
           path: ${{ runner.temp }}/release-artifact/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7c4d148..c5e1b34 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload snippet manifest
         if: matrix.python-version == '3.12'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: oilpriceapi-python-snippets-${{ github.sha }}
           path: artifacts/snippets/
@@ -76,7 +76,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.python-version == '3.12'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-report
           path: coverage.xml
diff --git a/.github/workflows/weekly-health.yml b/.github/workflows/weekly-health.yml
index be9bb8e..ce063a7 100644
--- a/.github/workflows/weekly-health.yml
+++ b/.github/workflows/weekly-health.yml
@@ -59,7 +59,7 @@ jobs:
 
       - name: Upload 30-day receipt
         if: always() && hashFiles('artifacts/sdk-health.json') != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sdk-health-${{ github.run_id }}
           path: artifacts/sdk-health.json
diff --git a/tests/test_release_readiness.py b/tests/test_release_readiness.py
index 19fe36d..6f070c2 100644
--- a/tests/test_release_readiness.py
+++ b/tests/test_release_readiness.py
@@ -135,7 +135,7 @@ def test_oidc_publisher_consumes_only_the_verified_artifact() -> None:
     action_refs = re.findall(r"uses:\s+[^@\s]+@([^\s#]+)", workflow)
 
     assert "Verify release tag matches package version and protected main" in workflow
-    assert "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" in workflow
+    assert "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9" in workflow
     assert "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333" in workflow
     assert "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33" in publish
     assert "id-token: write" in publish