diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13eb283..e0b221a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,7 +73,7 @@ jobs:
         if: matrix.leg == 'box'
         run: mix run tools/bench_mldsa.exs 500
       - if: matrix.leg == 'box'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mldsa87-sample
           path: mldsa87-sample/
diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml
index e1582f6..24fb24a 100644
--- a/.github/workflows/provenance.yml
+++ b/.github/workflows/provenance.yml
@@ -109,7 +109,7 @@ jobs:
           fi
           gh attestation verify "published-${v}.tar" --repo "${GITHUB_REPOSITORY}" \
             --signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/provenance.yml"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: tarball-${{ steps.build.outputs.version }}
           path: beam_mcp_signer-${{ steps.build.outputs.version }}.tar