diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9304c3..c042736 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,7 +108,7 @@ jobs:
           PY
           )
       - name: Upload package-acceptance evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: package-acceptance-${{ env.CI_SOURCE_SHA }}
           path: dist/
diff --git a/.github/workflows/hourly-product-development.yml b/.github/workflows/hourly-product-development.yml
index 22a4d8a..187df81 100644
--- a/.github/workflows/hourly-product-development.yml
+++ b/.github/workflows/hourly-product-development.yml
@@ -29,7 +29,7 @@ jobs:
       changed: ${{ steps.package.outputs.changed }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -244,7 +244,7 @@ jobs:
       VERIFIER_BASE_IMAGE: "python@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91"
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4cc8c80..b172c9d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -124,14 +124,14 @@ jobs:
             sha256sum --check --strict ../dist/SHA256SUMS
           )
       - name: Upload complete checksummed release evidence
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-evidence-${{ github.sha }}
           path: dist/
           if-no-files-found: error
           retention-days: 14
       - name: Upload canonical PyPI distributions
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pypi-distributions-${{ github.sha }}
           path: publish-dist/
@@ -530,7 +530,7 @@ jobs:
       id-token: write
     steps:
       - name: Download canonical reviewed distributions
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pypi-distributions-${{ github.sha }}
           path: dist
@@ -556,7 +556,7 @@ jobs:
       contents: write
     steps:
       - name: Download complete reviewed release evidence
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-evidence-${{ github.sha }}
           path: release-evidence
diff --git a/tests/test_release_contracts.py b/tests/test_release_contracts.py
index 6f11ca5..09f4a24 100644
--- a/tests/test_release_contracts.py
+++ b/tests/test_release_contracts.py
@@ -29,10 +29,10 @@
     "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33"
 )
 UPLOAD_ARTIFACT_ACTION = (
-    "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+    "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
 )
 DOWNLOAD_ARTIFACT_ACTION = (
-    "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
+    "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
 )