diff --git a/.github/workflows/pull-request-validation.yml b/.github/workflows/pull-request-validation.yml
index afb12b59..170387cf 100644
--- a/.github/workflows/pull-request-validation.yml
+++ b/.github/workflows/pull-request-validation.yml
@@ -91,7 +91,7 @@ jobs:
 
       - name: Upload .NET test results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dotnet-test-results
           path: TestResults
@@ -137,7 +137,7 @@ jobs:
 
       - name: Upload receiver acceptance evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: incident-receiver-acceptance
           path: TestResults/incident-receiver
@@ -167,7 +167,7 @@ jobs:
             ${{ runner.os }}-nuget-
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -200,7 +200,7 @@ jobs:
 
       - name: Upload Playwright reports and failure artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-artifacts
           path: |
@@ -238,7 +238,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -279,7 +279,7 @@ jobs:
 
       - name: Upload workspace browser evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-browser-${{ matrix.suite }}
           path: |
@@ -311,7 +311,7 @@ jobs:
             ${{ runner.os }}-nuget-
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
@@ -377,7 +377,7 @@ jobs:
 
       - name: Upload lifecycle evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mailbox-lifecycle-evidence
           path: artifacts/e2e/mailbox-lifecycle
@@ -463,7 +463,7 @@ jobs:
         run: tools/release/test-executable-archives.sh release-assets linux-x64
 
       - name: Upload release rehearsal assets
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-asset-rehearsal
           path: |
@@ -495,7 +495,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download the validated release rehearsal payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-asset-rehearsal
           path: release-assets
@@ -519,7 +519,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Node.js for actual host browser consent
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/rc7-source-audit.yml b/.github/workflows/rc7-source-audit.yml
index b4266997..53e36736 100644
--- a/.github/workflows/rc7-source-audit.yml
+++ b/.github/workflows/rc7-source-audit.yml
@@ -25,25 +25,25 @@ jobs:
           dotnet restore Helpdesk.sln
           tar -czf - -C /tmp/rateldesk-rc7 sdk packages | split -b 350M -d - "$RUNNER_TEMP/build-inputs.part"
           git ls-files '*AGENTS.md' '*SKILL.md'
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rc7-inputs-00
           path: ${{ runner.temp }}/build-inputs.part00
           compression-level: 0
           retention-days: 1
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rc7-inputs-01
           path: ${{ runner.temp }}/build-inputs.part01
           compression-level: 0
           retention-days: 1
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rc7-inputs-02
           path: ${{ runner.temp }}/build-inputs.part02
           compression-level: 0
           retention-days: 1
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rc7-inputs-03
           path: ${{ runner.temp }}/build-inputs.part03
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 59892a22..71578772 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -134,7 +134,7 @@ jobs:
         run: tools/release/test-publish-release-assets.sh
 
       - name: Transfer validated release payload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-assets
           path: |
@@ -184,7 +184,7 @@ jobs:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download the validated release payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-assets
           path: release-assets
@@ -396,7 +396,7 @@ jobs:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download the validated release payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-assets
           path: release-assets