diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4667323..e6e1a58 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,7 +71,7 @@ jobs:
       - run: bun install --frozen-lockfile
       - run: bunx playwright install --with-deps chromium webkit
       - run: bun run build && bun run test:e2e
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         with:
           name: browser-failures
diff --git a/.github/workflows/sealed-secret-transfer.yml b/.github/workflows/sealed-secret-transfer.yml
index f2a922d..9e880f4 100644
--- a/.github/workflows/sealed-secret-transfer.yml
+++ b/.github/workflows/sealed-secret-transfer.yml
@@ -45,7 +45,7 @@ jobs:
           TRANSFER_SECRET_VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: bun seal.ts toolbar
       - name: Upload ciphertext only
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: sealed-transfer-toolbar-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/sealed-secret-transfer/toolbar/sealed-transfer.json