diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c2db8c9..43a582d4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -280,7 +280,7 @@ jobs:
         timeout-minutes: 8
       - name: Retain checker output
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: verification-attempt-${{ github.run_attempt }}
           path: artifacts/verification/
@@ -334,7 +334,7 @@ jobs:
         timeout-minutes: 20
       - name: Retain checker output
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: verification-quint-${{ matrix.shard }}-attempt-${{ github.run_attempt }}
           path: artifacts/verification/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 051939b4..2fc7c8fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -209,7 +209,7 @@ jobs:
           const hashes = Object.fromEntries(names.map(name => [name, crypto.createHash("sha256").update(fs.readFileSync(path.join(process.env.DIRECTORY, name))).digest("hex")]));
           fs.appendFileSync(process.env.GITHUB_OUTPUT, `artifact_hashes=${JSON.stringify(hashes)}\n`);
           NODE
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: build_artifact
         with:
           name: canonical-build-${{ github.run_id }}-${{ github.run_attempt }}
@@ -401,7 +401,7 @@ jobs:
           cp -- "$BUNDLE_PATH" "$RUNNER_TEMP/ghostget-canonical/provenance.jsonl"
           bundle_sha256="$(sha256sum "$RUNNER_TEMP/ghostget-canonical/provenance.jsonl" | awk '{ print $1 }')"
           printf 'bundle_sha256=%s\n' "$bundle_sha256" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: attested_artifact
         with:
           name: canonical-attested-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/verification-nightly.yml b/.github/workflows/verification-nightly.yml
index 2b536a11..4a17ec7e 100644
--- a/.github/workflows/verification-nightly.yml
+++ b/.github/workflows/verification-nightly.yml
@@ -49,7 +49,7 @@ jobs:
         timeout-minutes: 230
       - name: Retain checker output
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: nightly-quint-attempt-${{ github.run_attempt }}
           path: artifacts/verification/
@@ -104,7 +104,7 @@ jobs:
         timeout-minutes: 50
       - name: Retain mutant logs
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: nightly-mutants-attempt-${{ github.run_attempt }}
           path: artifacts/verification/mutants/