diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44a741e..128936d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Test with coverage
         run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
       - name: Upload coverage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-go-${{ matrix.go }}
           path: coverage.out
@@ -182,7 +182,7 @@ jobs:
           ./scripts/check-upstream-advisories.sh "$RUNNER_TEMP/utls-upstream-advisories.json"
       - name: Preserve original uTLS advisory query
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: utls-upstream-advisories
           path: ${{ runner.temp }}/utls-upstream-advisories.json
@@ -194,7 +194,7 @@ jobs:
           ./scripts/check-upstream-advisories.sh "$RUNNER_TEMP/quic-official-upstream-advisories.json"
       - name: Preserve official QUIC source-lineage advisory query
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: quic-official-upstream-advisories
           path: ${{ runner.temp }}/quic-official-upstream-advisories.json
@@ -253,7 +253,7 @@ jobs:
             tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
           fi
           test -s "dist/${{ matrix.archive }}"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.artifact }}
           path: dist/${{ matrix.archive }}
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index a636f49..6b5c9d7 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -53,7 +53,7 @@ jobs:
           -parallel 2
       - name: Upload crashing inputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-${{ matrix.target }}-crashers
           path: ${{ matrix.package }}/testdata/fuzz/${{ matrix.target }}
diff --git a/.github/workflows/netem.yml b/.github/workflows/netem.yml
index 28e7001..c0f67d6 100644
--- a/.github/workflows/netem.yml
+++ b/.github/workflows/netem.yml
@@ -37,7 +37,7 @@ jobs:
         run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
       - name: Publish measurements and diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: netem-results
           path: artifacts/netem
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f26fa35..a27c059 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,7 +85,7 @@ jobs:
           cp "docs/releases/$GITHUB_REF_NAME.md" release-bundle/notes.md
           printf '\n发布提交：`%s`\n' "$RELEASE_COMMIT" >> release-bundle/notes.md
       - name: Preserve verified bundle for publishing
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-bundle
           path: release-bundle/
@@ -100,7 +100,7 @@ jobs:
       contents: write
       actions: read
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-bundle
           path: release-bundle