diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index dca13fe..059cb3c 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -61,7 +61,7 @@ jobs:
         PY
     - name: Preserve build and browser diagnostics
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: reactor-browser-diagnostics
         path: |
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 29744c2..4c8929b 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -46,20 +46,20 @@ jobs:
         with:
           distribution: temurin
           java-version: '17'
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Compile all libraries and the optional Jakarta application
         if: matrix.language == 'java-kotlin'
         run: ./mvnw -B -ntp clean package -PtestJakarta -DskipTests
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:${{ matrix.language }}
           output: target/codeql-results
       - name: Retain analysis reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codeql-${{ matrix.language }}
           path: target/codeql-results
diff --git a/.github/workflows/consumer-compatibility.yaml b/.github/workflows/consumer-compatibility.yaml
index 2dcea86..020e608 100644
--- a/.github/workflows/consumer-compatibility.yaml
+++ b/.github/workflows/consumer-compatibility.yaml
@@ -42,7 +42,7 @@ jobs:
         run: python3 compatibility/consumers.py prepare --repository "$RUNNER_TEMP/m2" 2>&1 | tee prepare.log
       - name: Verify artifact guards reject broken packages
         run: python3 -m unittest discover -s compatibility/tests 2>&1 | tee guards.log
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: packaged-consumers
           path: target/compatibility
@@ -50,7 +50,7 @@ jobs:
           if-no-files-found: error
       - name: Preserve build diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: consumer-build-diagnostics
           path: |
@@ -81,7 +81,7 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: packaged-consumers
           path: target/compatibility
@@ -92,7 +92,7 @@ jobs:
         run: python3 compatibility/consumers.py run --runtime ${{ matrix.java }} 2>&1 | tee runtime.log
       - name: Preserve runtime diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: consumer-java-${{ matrix.java }}-diagnostics
           path: runtime.log
@@ -134,7 +134,7 @@ jobs:
           done
       - name: Preserve Java 8 unit-test diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: consumer-java-8-unit-test-diagnostics
           path: |
@@ -172,7 +172,7 @@ jobs:
         run: ./mvnw -B -ntp clean verify 2>&1 | tee build.log
       - name: Preserve build diagnostics including compiler warnings
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: advisory-build-${{ matrix.java }}-diagnostics
           path: |
diff --git a/.github/workflows/dependency-submission.yaml b/.github/workflows/dependency-submission.yaml
index 3ddcf65..f8ebd16 100644
--- a/.github/workflows/dependency-submission.yaml
+++ b/.github/workflows/dependency-submission.yaml
@@ -88,7 +88,7 @@ jobs:
           gh api --method POST "repos/$GITHUB_REPOSITORY/dependency-graph/snapshots" --input target/release-build-snapshot.json
       - name: Preserve resolved graphs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dependency-graphs-${{ matrix.graph }}
           path: |