diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46a6b3e..11bb327 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -421,7 +421,7 @@ jobs:
           mkdir -p ../dist/pf-core-preview-bundle
           cp -a /tmp/pfcore-preview-bundle/. ../dist/pf-core-preview-bundle/
       - name: Upload preview release bundle
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pcs-core-ci-preview-bundle
           path: dist/pf-core-preview-bundle/
diff --git a/.github/workflows/pf-core-release-gate.yml b/.github/workflows/pf-core-release-gate.yml
index 1969df9..739a3e4 100644
--- a/.github/workflows/pf-core-release-gate.yml
+++ b/.github/workflows/pf-core-release-gate.yml
@@ -1,4 +1,4 @@
-name: PF-Core Release Gate
+name: PF-Core Release Gate
 
 # Live CertifyEdge + pin verification. Tag/release path is fail-closed.
 # Preview path (workflow_dispatch release_mode=preview): lean-check → bundle-release
@@ -195,7 +195,7 @@ jobs:
           cp -a /tmp/pfcore-preview-bundle/. ../dist/pf-core-preview-bundle/
       - name: Upload preview release bundle
         if: env.PCS_RELEASE_MODE == 'preview'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pcs-core-pf-core-preview-bundle
           path: dist/pf-core-preview-bundle/
diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
index 1ac73bb..1f77204 100644
--- a/.github/workflows/release-provenance.yml
+++ b/.github/workflows/release-provenance.yml
@@ -178,7 +178,7 @@ jobs:
           subject-path: dist/provenance/ReleaseProvenanceBinding.v0.json
 
       - name: Upload provenance package
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pcs-core-release-provenance
           path: dist/provenance
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 56d3fc4..dd0d157 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -522,7 +522,7 @@ jobs:
           subject-path: dist/provenance/ReleaseProvenanceBinding.v0.json
 
       - name: Upload local release artifacts (dry-run assembly)
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pcs-core-release-bundle-${{ env.PCS_RELEASE_MODE }}
           path: |