diff --git a/.github/workflows/CWI.yml b/.github/workflows/CWI.yml
index 9ba7965c26b..60350dcf328 100644
--- a/.github/workflows/CWI.yml
+++ b/.github/workflows/CWI.yml
@@ -94,7 +94,7 @@ jobs:
         run: go build -ldflags "-s -w" -o gh-aw.exe ./cmd/gh-aw
 
       - name: Upload Windows binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
         with:
           name: gh-aw-windows-amd64
           path: gh-aw.exe
diff --git a/.github/workflows/cgo.yml b/.github/workflows/cgo.yml
index 4a2aafe9d87..1685be3eedd 100644
--- a/.github/workflows/cgo.yml
+++ b/.github/workflows/cgo.yml
@@ -331,7 +331,7 @@ jobs:
 
       # Coverage reports for recent builds only - 7 days is sufficient for debugging recent changes
     - name: Upload coverage report
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: coverage-report-${{ matrix.shard }}
         path: coverage-${{ matrix.shard }}.html
@@ -339,7 +339,7 @@ jobs:
 
     - name: Upload unit test results
       if: always()    # Upload even if tests fail so canary-go can track coverage
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: test-result-cgo-unit-${{ matrix.shard }}
         path: test-result-unit-${{ matrix.shard }}.json
@@ -414,7 +414,7 @@ jobs:
 
     - name: Upload test coverage report
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: test-coverage-analysis-cgo
         path: |
@@ -514,7 +514,7 @@ jobs:
       run: make build
 
     - name: Upload Linux binary
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: gh-aw-linux-amd64
         path: gh-aw
@@ -1297,7 +1297,7 @@ jobs:
 
       # Benchmark results for performance trend analysis - 14 days allows comparison across multiple runs
     - name: Save benchmark results
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: benchmark-results
         path: bench_results.txt
@@ -1941,7 +1941,7 @@ jobs:
 
     - name: Upload fuzz test results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: fuzz-results-${{ matrix.group }}
         path: fuzz-results/
@@ -2565,7 +2565,7 @@ jobs:
 
     - name: Upload Defender scan logs
       if: always() && runner.os == 'Windows'
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: defender-scan-log-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/defender-scan-log.txt
@@ -2842,7 +2842,7 @@ jobs:
 
     - name: Upload conformance report
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: safe-outputs-conformance-report
         path: conformance-output.txt
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eab60b0039b..99959c84234 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -477,7 +477,7 @@ jobs:
 
     - name: Upload integration test results
       if: always()    # Upload even if tests fail so canary_go can track coverage
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: test-result-integration-${{ matrix.test-group.name }}
         path: test-result-integration-*.json
@@ -485,7 +485,7 @@ jobs:
 
     - name: Upload integration coverage artifacts
       if: always() && hashFiles(format('coverage-integration-{0}.out', steps.run-tests.outputs.safe_name)) != ''
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: ci-integration-coverage-${{ steps.run-tests.outputs.safe_name }}
         path: |
@@ -569,7 +569,7 @@ jobs:
       run: make build
 
     - name: Upload gh-aw binary artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: gh-aw-linux-amd64
         path: gh-aw
@@ -787,7 +787,7 @@ jobs:
         echo "- v0.x exposure: ${V0_PERCENT}%" >> $GITHUB_STEP_SUMMARY
 
     - name: Upload audit results
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: dependency-audit
         path: |
@@ -1388,7 +1388,7 @@ jobs:
 
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: test-result-integration-unauthenticated
         path: test-result-integration-unauthenticated.json
@@ -1463,7 +1463,7 @@ jobs:
 
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a   # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9   # v7.0.2
       with:
         name: test-result-integration-add-dispatch-workflow
         path: test-result-integration-add-dispatch-workflow.json
diff --git a/.github/workflows/credentials-check.yml b/.github/workflows/credentials-check.yml
index 1525d2603ed..92ab1b2259f 100644
--- a/.github/workflows/credentials-check.yml
+++ b/.github/workflows/credentials-check.yml
@@ -147,7 +147,7 @@ jobs:
         run: node scripts/agy-authentication.cjs
       - name: Upload sanitized authentication evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agy-native-authentication
           path: ${{ runner.temp }}/agy-auth-evidence/report.json
diff --git a/.github/workflows/daily-work-queue-formal-verification.lock.yml b/.github/workflows/daily-work-queue-formal-verification.lock.yml
index 3b0e39336dd..bc14a866b76 100644
--- a/.github/workflows/daily-work-queue-formal-verification.lock.yml
+++ b/.github/workflows/daily-work-queue-formal-verification.lock.yml
@@ -1152,7 +1152,7 @@ jobs:
           fi
       - if: always()
         name: Upload analysis handoff
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error
           name: work-queue-formal-handoff-${{ github.run_id }}-${{ github.run_attempt }}
@@ -1874,7 +1874,7 @@ jobs:
         shell: bash
       - name: Upload verification evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           compression-level: 6
           if-no-files-found: error
diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index f84879b4cea..37cf41e116c 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: install-test-${{ matrix.os }}
           path: install-output.log
@@ -254,7 +254,7 @@ jobs:
 
       - name: Upload PowerShell test results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: install-test-powershell-windows
           path: install-ps-output.log
diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index c2366f6bace..340fd9071f9 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -43,7 +43,7 @@ jobs:
           
       - name: Upload license report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v4.6.0
         with:
           name: license-report
           path: licenses.csv
diff --git a/.github/workflows/test-copilot-github-integration.yml b/.github/workflows/test-copilot-github-integration.yml
index bb372f4d9ac..8f5bd2495d8 100644
--- a/.github/workflows/test-copilot-github-integration.yml
+++ b/.github/workflows/test-copilot-github-integration.yml
@@ -79,7 +79,7 @@ jobs:
       
       - name: Upload execution logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agent-logs
           path: |
diff --git a/.github/workflows/windows-cli-integration.yml b/.github/workflows/windows-cli-integration.yml
index 5abdda4b47b..580b2178786 100644
--- a/.github/workflows/windows-cli-integration.yml
+++ b/.github/workflows/windows-cli-integration.yml
@@ -39,7 +39,7 @@ jobs:
           echo "✅ Built gh-aw.exe ($(du -h gh-aw.exe | cut -f1))" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload Windows binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: gh-aw-windows-amd64
           path: gh-aw.exe