diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 488a1cb..c4dba3a 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -29,7 +29,7 @@ jobs:
         run: cargo +nightly fuzz run parse-and-check -- -max_total_time=300 -max_len=4096
       - name: Upload crash artifacts
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fuzz-crash-artifacts
           path: fuzz/artifacts/
diff --git a/.github/workflows/release-vscode.yml b/.github/workflows/release-vscode.yml
index 243c5eb..efb68e2 100644
--- a/.github/workflows/release-vscode.yml
+++ b/.github/workflows/release-vscode.yml
@@ -122,7 +122,7 @@ jobs:
         working-directory: editors/code
         run: bunx @vscode/vsce package --target ${{ matrix.code-target }} --no-dependencies ${{ inputs.pre-release && '--pre-release' || '' }}
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ry-vscode-${{ matrix.code-target }}
           path: editors/code/*.vsix