diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 2485e6e..ca0764f 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -45,7 +45,7 @@ jobs:
         run: cargo bench --bench config_parsing --bench registry_lookup --bench version_comparison -- --noplot
 
       - name: Store benchmark results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: benchmark-results
           path: target/criterion/
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 2d0ebda..ff3a658 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -77,7 +77,7 @@ jobs:
           JARVY_FAST_TEST: 1
 
       - name: Upload HTML coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: coverage-report
           path: target/llvm-cov/html/
diff --git a/.github/workflows/e2e-cross-platform.yml b/.github/workflows/e2e-cross-platform.yml
index 7154cfc..fec58ee 100644
--- a/.github/workflows/e2e-cross-platform.yml
+++ b/.github/workflows/e2e-cross-platform.yml
@@ -134,7 +134,7 @@ jobs:
 
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: e2e-results-${{ matrix.platform }}
           path: |
@@ -184,7 +184,7 @@ jobs:
   #
   #     - name: Upload Results
   #       if: always()
-  #       uses: actions/upload-artifact@v7
+  #       uses: actions/upload-artifact@v7.0.1
   #       with:
   #         name: e2e-results-${{ matrix.platform }}
   #         path: target/e2e-results/
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index d71cd63..343bdcb 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -68,14 +68,14 @@ jobs:
         continue-on-error: true
 
       - name: Upload corpus
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: fuzz-corpus-${{ matrix.target }}
           path: fuzz/corpus/${{ matrix.target }}
           retention-days: 90
 
       - name: Upload crash artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         if: failure()
         with:
           name: fuzz-crashes-${{ matrix.target }}
diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
index 2dfc6b6..4a50354 100644
--- a/.github/workflows/helm-release.yml
+++ b/.github/workflows/helm-release.yml
@@ -152,7 +152,7 @@ jobs:
 
       - name: Upload rendered manifests as workflow artifact
         if: always()
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: helm-rendered-${{ steps.version.outputs.version }}
           path: /tmp/render/
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 962035e..6789766 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -104,7 +104,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload mutation results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: mutation-results
           path: mutants.out/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 37fda28..094fb7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -166,7 +166,7 @@ jobs:
             cargo generate-rpm
           fi
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ matrix.platform }}${{ matrix.cross && format('-{0}', matrix.pkg_arch) || '' }}-release-artifacts
           path: ${{ matrix.artifact_paths }}
@@ -278,7 +278,7 @@ jobs:
           done
 
       - name: Upload SBOMs
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: sbom-${{ env.VERSION }}
           path: |
@@ -329,7 +329,7 @@ jobs:
           done
 
       - name: Upload signed artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: signed-artifacts-${{ env.VERSION }}
           path: |
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 872236d..af16708 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -175,7 +175,7 @@ jobs:
           echo '```' >> $GITHUB_STEP_SUMMARY
 
       - name: Upload geiger report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: geiger-report
           path: geiger-report.txt