diff --git a/.github/workflows/build-ironic-images.yaml b/.github/workflows/build-ironic-images.yaml
index e28ab739e..2be66be82 100644
--- a/.github/workflows/build-ironic-images.yaml
+++ b/.github/workflows/build-ironic-images.yaml
@@ -67,7 +67,7 @@ jobs:
         run: ls -la artifacts
 
       - name: Save artifacts for next job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: image-artifacts
           path: ironic-images/artifacts/
@@ -127,7 +127,7 @@ jobs:
         run: ls -la artifacts && cp -R artifacts/* upload/
 
       - name: Upload pull request image artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: ${{ github.event_name == 'pull_request' }}
         with:
           name: understack-image-${{ github.event.pull_request.number }}-${{ env.distro }}-${{ env.release }}
diff --git a/.github/workflows/code-test.yaml b/.github/workflows/code-test.yaml
index df9ad8fe6..f450fcd17 100644
--- a/.github/workflows/code-test.yaml
+++ b/.github/workflows/code-test.yaml
@@ -60,7 +60,7 @@ jobs:
           else
             uv run pytest --cov --cov-report xml:coverage.xml --junitxml=junit.xml
           fi
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-${{ matrix.project }}
           path: python/${{ matrix.project }}/coverage.xml
@@ -80,7 +80,7 @@ jobs:
           fi
       # Keep each project's JUnit for the consolidated publish-test-results job.
       # if-no-files-found=ignore: stestr projects don't emit junit.xml.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: ${{ always() }}
         with:
           name: junit-${{ matrix.project }}
@@ -99,7 +99,7 @@ jobs:
           merge-multiple: true
       - run: |
           npx cobertura-merge-globby -o output.xml --files=python/**/coverage.xml
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage.xml
           path: coverage.xml