diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml
index 87c3766..b69a9e4 100644
--- a/.github/workflows/build-preview.yml
+++ b/.github/workflows/build-preview.yml
@@ -36,7 +36,7 @@ jobs:
           bash scripts/build-windows-legacy.sh
           (cd dist && sha256sum php2shell-* > SHA256SUMS)
       - name: Upload preview artifact – unsigned and not production approved
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: php2shell-native-unsigned-preview
           path: dist/
diff --git a/.github/workflows/nginx-fpm-labs.yml b/.github/workflows/nginx-fpm-labs.yml
index e3693b4..683661c 100644
--- a/.github/workflows/nginx-fpm-labs.yml
+++ b/.github/workflows/nginx-fpm-labs.yml
@@ -102,7 +102,7 @@ jobs:
 
       - name: Upload LIVE_DOCKER artifacts
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nginx-fpm-live-docker-${{ github.run_id }}
           path: |