diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 210ec1a..6c0952e 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -73,7 +73,7 @@ jobs:
         run: pip install pip-audit && pip-audit -r requirements.txt --desc --output-format json --output-file safety-report.json || true
 
       - name: Upload security reports
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: security-reports
@@ -121,7 +121,7 @@ jobs:
             --junitxml=junit-middleware.xml
 
       - name: Upload middleware test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: middleware-test-results
@@ -186,7 +186,7 @@ jobs:
             -n auto
 
       - name: Upload unit test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: unit-test-results-${{ matrix.python-version }}
@@ -282,7 +282,7 @@ jobs:
           REDIS_URL: redis://localhost:6379/0
 
       - name: Upload integration test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: integration-test-results
@@ -344,7 +344,7 @@ jobs:
       # npm ci sin --legacy-peer-deps moría de ERESOLVE con TS7.
 
       - name: Upload E2E test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: e2e-test-results
@@ -390,7 +390,7 @@ jobs:
             --junitxml=junit-performance.xml || echo "Performance tests completed with warnings"
 
       - name: Upload performance results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: performance-test-results
@@ -434,7 +434,7 @@ jobs:
         run: pip-audit -r requirements.txt --desc --output-format json --output-file dependency-scan.json || true
 
       - name: Upload security test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: security-test-results
@@ -462,7 +462,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Download all coverage reports
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: '*-test-results*'
           merge-multiple: true
@@ -481,7 +481,7 @@ jobs:
           fail_ci_if_error: false
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report
           path: coverage-report/
@@ -511,7 +511,7 @@ jobs:
           mkdocs build
 
       - name: Upload documentation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: documentation
           path: site/
@@ -545,7 +545,7 @@ jobs:
           trivy filesystem --format cyclonedx --output qa-framework-sbom.cdx .
 
       - name: Upload SBOM as artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom
           path: qa-framework-sbom.cdx
@@ -585,7 +585,7 @@ jobs:
         run: twine check dist/*
 
       - name: Upload package
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: package
           path: dist/
@@ -600,7 +600,7 @@ jobs:
     if: always()
     steps:
       - name: Download all test results
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: '*-test-results*'
           merge-multiple: true
diff --git a/.github/workflows/dast-zap.yml b/.github/workflows/dast-zap.yml
index 2faa6c1..0b68a8c 100644
--- a/.github/workflows/dast-zap.yml
+++ b/.github/workflows/dast-zap.yml
@@ -105,7 +105,7 @@ jobs:
           category: zap-dast
 
       - name: Upload SARIF + JSON artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: zap-dast-results
@@ -157,7 +157,7 @@ jobs:
     if: always()
     steps:
       - name: Download ZAP results
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: zap-dast-results
         continue-on-error: true
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 445960a..3183e30 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload test artifacts
         if: '!cancelled()'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report
           path: |
@@ -115,7 +115,7 @@ jobs:
 
       - name: Upload test artifacts
         if: '!cancelled()'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-prod
           path: |
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 72b460c..5e19b70 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -177,7 +177,7 @@ jobs:
           echo "Tests for '${{ matrix.test-type }}' were skipped (not implemented yet)" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: ${{ matrix.test-type }}-py${{ matrix.python-version }}-results
@@ -197,7 +197,7 @@ jobs:
     if: always()
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: '*-results'
           merge-multiple: true
@@ -227,7 +227,7 @@ jobs:
           fi
 
       - name: Upload nightly report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-report
           path: nightly-report.md
diff --git a/.github/workflows/owasp-security.yml b/.github/workflows/owasp-security.yml
index 1beeb22..278200b 100644
--- a/.github/workflows/owasp-security.yml
+++ b/.github/workflows/owasp-security.yml
@@ -57,7 +57,7 @@ jobs:
           category: semgrep-owasp
 
       - name: Upload Semgrep artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: semgrep-results
@@ -117,7 +117,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload OWASP test report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: owasp-compliance-report
@@ -155,7 +155,7 @@ jobs:
           syft . -o spdx-json > sbom-syft-spdx.json
 
       - name: Upload SBOM artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom-syft
           path: |
@@ -173,7 +173,7 @@ jobs:
     if: always()
     steps:
       - name: Download Semgrep results
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         continue-on-error: true  # step-level: download-artifact has no such input
         with:
           name: semgrep-results
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index b3b7925..b9987a1 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -210,7 +210,7 @@ jobs:
 
       - name: Upload middleware test results
         if: steps.changed-files.outputs.run_middleware_tests == 'true' && always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: middleware-test-results
           path: |
diff --git a/.github/workflows/pr-deploy-coolify.yml b/.github/workflows/pr-deploy-coolify.yml
index eb36707..b271aa6 100644
--- a/.github/workflows/pr-deploy-coolify.yml
+++ b/.github/workflows/pr-deploy-coolify.yml
@@ -116,7 +116,7 @@ jobs:
 
       - name: Upload backend image artifact
         if: vars.COOLIFY_CONFIGURED == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: backend-image
           path: /tmp/qa-backend-image.tar.gz
@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload frontend image artifact
         if: vars.COOLIFY_CONFIGURED == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: frontend-image
           path: /tmp/qa-frontend-image.tar.gz
@@ -175,7 +175,7 @@ jobs:
       status: ${{ steps.deploy.outputs.status }}
     steps:
       - name: Download backend image (built by security-gate)
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: backend-image
           path: ./image
@@ -317,7 +317,7 @@ jobs:
       status: ${{ steps.deploy.outputs.status }}
     steps:
       - name: Download frontend image (built by security-gate)
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: frontend-image
           path: ./image
@@ -554,7 +554,7 @@ jobs:
 
       - name: Upload test artifacts (report + visual spot-check)
         if: '!cancelled()'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-preview
           path: |
diff --git a/.github/workflows/slsa-provenance.yml b/.github/workflows/slsa-provenance.yml
index 98f6f0c..374e06b 100644
--- a/.github/workflows/slsa-provenance.yml
+++ b/.github/workflows/slsa-provenance.yml
@@ -70,7 +70,7 @@ jobs:
           subject-name: ${{ github.repository }}@${{ github.sha }}
 
       - name: Upload package artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-package
           path: dist/
@@ -85,7 +85,7 @@ jobs:
     needs: [provenance]
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: python-package
           path: dist/
diff --git a/.github/workflows/trivy-security.yml b/.github/workflows/trivy-security.yml
index 117223c..9dc858b 100644
--- a/.github/workflows/trivy-security.yml
+++ b/.github/workflows/trivy-security.yml
@@ -69,7 +69,7 @@ jobs:
           category: 'trivy-fs'
 
       - name: Upload FS scan results artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: trivy-fs-results
@@ -128,7 +128,7 @@ jobs:
           category: 'trivy-backend-image'
 
       - name: Upload backend scan artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: trivy-backend-image-results
@@ -168,7 +168,7 @@ jobs:
           category: 'trivy-frontend-image'
 
       - name: Upload frontend scan artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: trivy-frontend-image-results
@@ -204,7 +204,7 @@ jobs:
           TRIVY_SKIP_DB_UPDATE: "true"
 
       - name: Upload SBOM artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom-reports
           path: |
@@ -251,7 +251,7 @@ jobs:
           category: 'trivy-iac'
 
       - name: Upload IaC scan artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: trivy-iac-results
@@ -268,7 +268,7 @@ jobs:
     if: github.event_name == 'pull_request' && always()
     steps:
       - name: Download all Trivy artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: 'trivy-*-results'
           merge-multiple: true
@@ -378,7 +378,7 @@ jobs:
     if: always()
     steps:
       - name: Download all Trivy artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: 'trivy-*-results'
           merge-multiple: true