diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96a4feec..dab2d4f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -471,7 +471,7 @@ jobs:
 
       - name: Upload error diagnostics
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: error-test-results
           path: tests/golden/errors/test_results.json
@@ -525,7 +525,7 @@ jobs:
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: playwright-report
           path: tests/playwright-report/
@@ -533,7 +533,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: playwright-results
           path: tests/playwright-results.json
diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml
index b6211aa5..2a70791b 100644
--- a/.github/workflows/formal-verification.yml
+++ b/.github/workflows/formal-verification.yml
@@ -278,7 +278,7 @@ jobs:
 
       - name: Upload ProVerif Results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: proverif-results-${{ matrix.shard_key }}
           path: |
@@ -418,7 +418,7 @@ jobs:
 
       - name: Upload TLA+ Results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: tla-results-${{ matrix.shard_key }}
           path: |
@@ -517,7 +517,7 @@ jobs:
 
       - name: Upload Lean Results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: lean-results-${{ matrix.shard_key }}
           path: |
@@ -696,7 +696,7 @@ jobs:
 
       - name: Upload Tamarin Results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: tamarin-results-${{ matrix.shard_key }}
           path: |
@@ -743,7 +743,7 @@ jobs:
 
       - name: Upload Verus Results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: verus-results
           path: verus_output.txt
@@ -799,7 +799,7 @@ jobs:
 
       - name: Upload timing results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: constant-time-stats
           path: crypto_core/ct_bench_output.txt
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 5494e027..2345ffc2 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: fuzz-crashes-${{ matrix.shard_key }}-${{ github.run_id }}
           path: fuzz/crashes/
@@ -253,7 +253,7 @@ jobs:
 
       - name: Upload AFL++ results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: afl-results-${{ matrix.shard_key }}
           path: fuzz/afl-output/${{ matrix.shard_key }}/
diff --git a/.github/workflows/long-fuzz.yml b/.github/workflows/long-fuzz.yml
index 67f0e648..16e3b559 100644
--- a/.github/workflows/long-fuzz.yml
+++ b/.github/workflows/long-fuzz.yml
@@ -160,7 +160,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: long-fuzz-crashes-${{ matrix.shard_key }}-${{ github.run_id }}
           path: fuzz/crashes/
@@ -168,7 +168,7 @@ jobs:
 
       - name: Upload corpus (for corpus sharing with main fuzz.yml)
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: long-fuzz-corpus-${{ matrix.shard_key }}-${{ github.run_id }}
           path: fuzz/corpus/
diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml
index f1119684..b01772ca 100644
--- a/.github/workflows/mutation-testing.yml
+++ b/.github/workflows/mutation-testing.yml
@@ -137,7 +137,7 @@ jobs:
 
       - name: Upload mutation report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-mutation-report
           path: .mutmut-cache/
@@ -198,7 +198,7 @@ jobs:
 
       - name: Upload Rust mutation report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: rust-mutation-report
           path: crypto_core/mutants.out/
diff --git a/.github/workflows/pyinstaller.yml b/.github/workflows/pyinstaller.yml
index 035f646d..f81913cb 100644
--- a/.github/workflows/pyinstaller.yml
+++ b/.github/workflows/pyinstaller.yml
@@ -110,7 +110,7 @@ jobs:
           fi
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: meow-decoder-linux-x64
           path: dist/meow-decoder
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ba94b34..2c046eb3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
           echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: python-package
           path: dist/
diff --git a/.github/workflows/rust-crypto.yml b/.github/workflows/rust-crypto.yml
index 9f111423..3257f682 100644
--- a/.github/workflows/rust-crypto.yml
+++ b/.github/workflows/rust-crypto.yml
@@ -73,7 +73,7 @@ jobs:
           MEOW_PRODUCTION_MODE: "0" # Required alongside MEOW_TEST_MODE to allow export_key() in tests
 
       - name: Upload wheel
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: wheel-linux-py${{ matrix.python-version }}
           path: rust_crypto/dist/*.whl
@@ -118,7 +118,7 @@ jobs:
           python -c "import meow_crypto_rs; print(f'Rust backend loaded: {meow_crypto_rs.backend_info()}')"
 
       - name: Upload wheel
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: wheel-macos-${{ matrix.target }}-py${{ matrix.python-version }}
           path: rust_crypto/dist/*.whl
@@ -161,7 +161,7 @@ jobs:
         shell: pwsh
 
       - name: Upload wheel
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: wheel-windows-py${{ matrix.python-version }}
           path: rust_crypto/dist/*.whl
@@ -187,7 +187,7 @@ jobs:
           manylinux: auto
 
       - name: Upload wheels
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: wheel-manylinux-${{ matrix.target }}
           path: dist/*.whl
diff --git a/.github/workflows/rust-security-suite.yml b/.github/workflows/rust-security-suite.yml
index bcb3086a..d92dd934 100644
--- a/.github/workflows/rust-security-suite.yml
+++ b/.github/workflows/rust-security-suite.yml
@@ -230,7 +230,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: fuzz-crashes-${{ matrix.target }}
           path: rust_crypto/fuzz/artifacts/${{ matrix.target }}/
@@ -321,7 +321,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: crypto-core-fuzz-crashes-${{ matrix.target }}
           path: crypto_core/fuzz/artifacts/${{ matrix.target }}/
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c402f134..e8ac51b9 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -53,7 +53,7 @@ jobs:
           sarif_file: results.sarif
 
       - name: Upload Scorecard results as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: scorecard-results
           path: results.sarif
diff --git a/.github/workflows/security-ci.yml b/.github/workflows/security-ci.yml
index 47b7236b..49a868ca 100644
--- a/.github/workflows/security-ci.yml
+++ b/.github/workflows/security-ci.yml
@@ -224,7 +224,7 @@ jobs:
           echo "✅ Rust SBOM generated"
 
       - name: Upload SBOMs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
         with:
           name: sbom-artifacts
           path: |