diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5463fd6..890bfed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,7 +69,7 @@ jobs:
         run: pnpm test:coverage
 
       - name: Upload frontend coverage
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: coverage-frontend
           path: coverage/frontend
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload Playwright report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: playwright-report
           path: |
diff --git a/.github/workflows/dependency-watch.yml b/.github/workflows/dependency-watch.yml
index 0e77a9e..6534175 100644
--- a/.github/workflows/dependency-watch.yml
+++ b/.github/workflows/dependency-watch.yml
@@ -168,7 +168,7 @@ jobs:
 
       - name: Upload dependency reports
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: dependency-watch-reports
           path: |
diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml
index 4d24743..7d56804 100644
--- a/.github/workflows/osv-scan.yml
+++ b/.github/workflows/osv-scan.yml
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload raw OSV output as artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: osv-scan-report
           path: osv-scan.sarif
diff --git a/.github/workflows/perf-foundation.yml b/.github/workflows/perf-foundation.yml
index 484000b..29968e3 100644
--- a/.github/workflows/perf-foundation.yml
+++ b/.github/workflows/perf-foundation.yml
@@ -22,7 +22,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm build:ui
       - run: pnpm perf:bundle
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: perf-foundation-bundle
@@ -44,7 +44,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm perf:build
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: perf-foundation-build
@@ -91,7 +91,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm perf:memory
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: perf-foundation-memory
@@ -110,7 +110,7 @@ jobs:
         env:
           BASE_URL: ${{ vars.PERF_BASE_URL }}
           AUTH_TOKEN: ${{ secrets.PERF_API_KEY }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: perf-foundation-api
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index 38639ce..533e60d 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload test artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: test-artifacts
           path: |
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index d52fd1b..9291186 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -74,7 +74,7 @@ jobs:
         run: ls -la sbom-*.cdx.json sbom-cargo.cdx.json 2>/dev/null || ls -la sbom-*.json
 
       - name: Upload SBOMs as workflow artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: sbom-${{ github.event.release.tag_name || github.run_id }}
           path: |