diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5cdfee2..04b316f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -217,7 +217,7 @@ jobs:
       # its original target/release/ path so binding test code works
       # unchanged.
       - name: Upload native lib artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: native-lib-${{ matrix.os }}
           retention-days: 1
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 9d64e08..69e6c41 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -146,7 +146,7 @@ jobs:
           manylinux: ${{ matrix.manylinux }}
           args: --release --features python --out dist
       - name: Upload wheels as artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-linux-${{ matrix.target }}-${{ matrix.manylinux }}
           path: dist/*.whl
@@ -172,7 +172,7 @@ jobs:
           target: ${{ matrix.target }}
           args: --release --features python --out dist
       - name: Upload wheels as artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-macos-${{ matrix.target }}
           path: dist/*.whl
@@ -199,7 +199,7 @@ jobs:
           target: ${{ matrix.target }}
           args: --release --features python --out dist
       - name: Upload wheels as artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-windows-${{ matrix.target }}
           path: dist/*.whl
@@ -217,7 +217,7 @@ jobs:
           command: sdist
           args: --out dist
       - name: Upload sdist as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sdist
           path: dist/*.tar.gz
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f0fc82a..d9cf0fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -162,7 +162,7 @@ jobs:
           echo "ARCHIVE=$ARCHIVE" >> $GITHUB_ENV
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ env.ARCHIVE }}
@@ -232,7 +232,7 @@ jobs:
           cp target/${{ matrix.target }}/release/office_oxide.lib staging/lib/ 2>/dev/null || true
           cp -r include/office_oxide_c staging/include/
           cd staging && 7z a "../${{ matrix.artifact_name }}.zip" . && cd ..
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.artifact_name }}
           path: |
@@ -326,7 +326,7 @@ jobs:
           printf '{"type": "module"}\n'   > wasm-pkg/web/package.json
 
       - name: Upload WASM artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wasm-package
           path: wasm-pkg/
@@ -380,7 +380,7 @@ jobs:
         run: maturin build --release --features python --target ${{ matrix.target }} --out dist
 
       - name: Upload wheels
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.artifact_name }}
           path: dist/*.whl
@@ -431,7 +431,7 @@ jobs:
             done
           done
           ls -R js/prebuilds
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: node-native-package
           path: js/
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c5ee089..ad0721f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -35,7 +35,7 @@ jobs:
           publish_results: true
 
       - name: Upload Scorecard results as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
           path: results.sarif