diff --git a/.github/workflows/danfse-visual.yml b/.github/workflows/danfse-visual.yml
index 9356eb1..2b63261 100644
--- a/.github/workflows/danfse-visual.yml
+++ b/.github/workflows/danfse-visual.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Preserve render evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: danfse-visual-evidence
           path: ${{ runner.temp }}/danfse/*.pdf
diff --git a/.github/workflows/nt009-evidence.yml b/.github/workflows/nt009-evidence.yml
index 305f32b..f27acfe 100644
--- a/.github/workflows/nt009-evidence.yml
+++ b/.github/workflows/nt009-evidence.yml
@@ -54,7 +54,7 @@ jobs:
         run: php tools/bin/domains.php schema-packages --report="${{ runner.temp }}/nt009-xsd-packages.json"
       - name: Retain full evidence for manual review
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nt009-official-source-evidence
           path: |
diff --git a/.github/workflows/official-snapshot-reproduction.yml b/.github/workflows/official-snapshot-reproduction.yml
index 5665206..7e9002e 100644
--- a/.github/workflows/official-snapshot-reproduction.yml
+++ b/.github/workflows/official-snapshot-reproduction.yml
@@ -41,7 +41,7 @@ jobs:
             --annex-c="${{ runner.temp }}/official/annex-c.xlsx"
       - name: Preserve source workbooks for manual review
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-production-domain-sources
           path: ${{ runner.temp }}/official/*.xlsx
diff --git a/.github/workflows/source-watch.yml b/.github/workflows/source-watch.yml
index 8940517..77e46fd 100644
--- a/.github/workflows/source-watch.yml
+++ b/.github/workflows/source-watch.yml
@@ -28,7 +28,7 @@ jobs:
         run: php tools/bin/domains.php watch --report="${{ runner.temp }}/nfse-sources-report.json"
       - name: Retain diff evidence without modifying the repository
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-nfse-source-check
           path: ${{ runner.temp }}/nfse-sources-report.json