diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index 57d149b..dd2ee90 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -61,7 +61,7 @@ jobs:
 
       - name: Upload mutants.out
         if: ${{ !cancelled() && steps.rust-diff.outputs.needed == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutants-incremental.out
           path: mutants.out
diff --git a/.github/workflows/nightly-recovery.yml b/.github/workflows/nightly-recovery.yml
index 67564ef..af52b81 100644
--- a/.github/workflows/nightly-recovery.yml
+++ b/.github/workflows/nightly-recovery.yml
@@ -244,7 +244,7 @@ jobs:
           echo "origin=$origin" >>"$GITHUB_OUTPUT"
           echo "release_id=$release_id" >>"$GITHUB_OUTPUT"; echo "date=$date" >>"$GITHUB_OUTPUT"; echo "version=$version" >>"$GITHUB_OUTPUT"
           echo "origin_manifest_sha256=$origin_manifest" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-plan, path: nightly-recovery-plan.json, retention-days: 90}
 
   build:
@@ -290,7 +290,7 @@ jobs:
           bash scripts/package-nightly.sh
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: 'target/nightly/codex-warp-${{ inputs.tag }}-${{ matrix.target }}.*'}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: 'nightly-recovery-build-${{ matrix.target }}', path: target/nightly/, if-no-files-found: error}
 
   collect:
@@ -315,7 +315,7 @@ jobs:
           jq -r '.artifacts[]|[.archiveSha256,.archive]|@tsv' candidate/codex-warp-nightly-manifest.json | sed $'s/\t/  /' >candidate/sha256.sum
           rm "${evidence[@]}"
           bash scripts/check-nightly-assets.sh candidate candidate/codex-warp-nightly-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   load-origin:
@@ -362,7 +362,7 @@ jobs:
           NIGHTLY_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/nightly-manifest.schema.json" bash scripts/check-nightly-assets.sh candidate candidate/codex-warp-nightly-manifest.json "$PWD/release-source"
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --arg workflow "https://github.com/${{ github.repository }}/actions/runs/$ORIGIN_RUN_ID" '.tag==$tag and .sourceSha==$sha and .workflow==$workflow' candidate/codex-warp-nightly-manifest.json >/dev/null
           for archive in candidate/*.tar.xz candidate/*.zip; do bash scripts/verify-nightly-attestation.sh "$archive" candidate/codex-warp-nightly-manifest.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   mutate-release:
@@ -446,7 +446,7 @@ jobs:
           candidate_assets="$({ while IFS= read -r file; do jq -n --arg name "$(basename "$file")" --arg digest "$(bash scripts/sha256-file.sh "$file")" '{name:$name,sha256:$digest}'; done < <(find candidate -maxdepth 1 -type f -print | sort); } | jq -sc '.')"
           branch_sha="$(git ls-remote --heads origin refs/heads/nightly | awk '{print $1}')"
           jq -n --arg operation "$OPERATION" --arg tag "$TAG" --arg source "$SOURCE_SHA" --argjson release_id "$release_id" --argjson release_state "$release_state" --argjson remote_assets "$remote_assets" --argjson candidate_assets "$candidate_assets" --arg manifest "$(bash scripts/sha256-file.sh candidate/codex-warp-nightly-manifest.json)" --arg plan "$(bash scripts/sha256-file.sh retained-plan/nightly-recovery-plan.json)" --arg tag_sha "$(git rev-parse "refs/tags/$TAG^{}")" --arg branch "$branch_sha" --arg workflow "${{ github.workflow_sha }}" --arg origin_run "$ORIGIN_RUN_ID" --arg origin_attempt "$ORIGIN_RUN_ATTEMPT" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" '{schemaVersion:1,operation:$operation,tag:$tag,sourceSha:$source,releaseId:$release_id,releaseState:$release_state,remoteAssets:$remote_assets,candidateAssets:$candidate_assets,manifestSha256:$manifest,planSha256:$plan,tagSha:$tag_sha,branchSha:(if ($branch|length)>0 then $branch else null end),controlWorkflowSha:$workflow,originRunId:(if ($origin_run|length)>0 then ($origin_run|tonumber) else null end),originRunAttempt:(if ($origin_attempt|length)>0 then ($origin_attempt|tonumber) else null end),runId:$run,runAttempt:$attempt}' >nightly-orphan-recovery-intent.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-orphan-recovery-intent, path: nightly-orphan-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-orphan-recovery-intent.json}
@@ -499,7 +499,7 @@ jobs:
           live_releases="$(gh api --paginate "repos/${{ github.repository }}/releases?per_page=100" | jq -sc 'add // []')"
           [ "$(jq --arg tag "$TAG" --argjson id "$RELEASE_INPUT" '[.[] | select(.id==$id or .tag_name==$tag)] | length' <<<"$live_releases")" -eq 0 ]
           jq -n --arg tag "$TAG" --arg source "$SOURCE_SHA" --arg intent "$(bash scripts/sha256-file.sh nightly-orphan-recovery-intent.json)" --argjson release_id "$RELEASE_INPUT" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" '{schemaVersion:1,tag:$tag,sourceSha:$source,deletedReleaseId:$release_id,intentSha256:$intent,runId:$run,runAttempt:$attempt}' >nightly-deletion-receipt.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: inputs.operation == 'replace-unpublished-draft'
         with: {name: nightly-deletion-receipt, path: nightly-deletion-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 934fa18..60ed965 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -136,7 +136,7 @@ jobs:
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: target/nightly/codex-warp-${{ needs.prepare.outputs.tag }}-${{ matrix.target }}.*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-${{ matrix.target }}
           path: target/nightly/
@@ -180,7 +180,7 @@ jobs:
           jq -r '.artifacts[] | [.archiveSha256,.archive] | @tsv' nightly-assets/codex-warp-nightly-manifest.json | sed $'s/\t/  /' >nightly-assets/sha256.sum
           rm "${evidence[@]}"
           SOURCE_DIR="$PWD" bash scripts/check-nightly-assets.sh nightly-assets nightly-assets/codex-warp-nightly-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-release-candidate
           path: nightly-assets/
@@ -224,7 +224,7 @@ jobs:
             --argjson inventory "$(find nightly-assets -maxdepth 1 -type f -printf '%f\n' | sort | jq -Rsc 'split("\n")[:-1]')" \
             '{schemaVersion:1,operation:"fresh-nightly",repository:$repository,tag:$tag,sourceSha:$source,priorBranchSha:(if ($branch|length)>0 then $branch else null end),tagAbsent:true,releaseAbsent:true,workflowSha:$workflow_sha,runId:$run_id,runAttempt:$attempt,manifestSha256:$manifest,inventory:$inventory}' >nightly-intent.json
       - id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-publication-intent
           path: nightly-intent.json
@@ -297,7 +297,7 @@ jobs:
           WORKFLOW_SHA: ${{ github.workflow_sha }}
         run: bash scripts/create-nightly-tag.sh
       - id: receipt
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-tag-creation-receipt, path: nightly-tag-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-tag-receipt.json}
diff --git a/.github/workflows/release-recovery.yml b/.github/workflows/release-recovery.yml
index 74effa8..dd10e25 100644
--- a/.github/workflows/release-recovery.yml
+++ b/.github/workflows/release-recovery.yml
@@ -146,7 +146,7 @@ jobs:
           echo "resume=$resume" >>"$GITHUB_OUTPUT"
           echo "remote=$remote" >>"$GITHUB_OUTPUT"
           echo "matrix=$matrix" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-recovery-plan
           path: official-recovery-plan.json
@@ -193,7 +193,7 @@ jobs:
       - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: target/distrib/codex-warp-${{ matrix.target }}.*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-recovery-build-${{ matrix.target }}
           path: target/distrib/
@@ -255,7 +255,7 @@ jobs:
           jq -n --argjson publishable true --arg repository "${{ github.repository }}" --arg source "$SOURCE_SHA" --arg version "${TAG#v}" --arg lock "$(bash scripts/sha256-file.sh release-source/Cargo.lock)" --arg toolchain "$(bash scripts/sha256-file.sh release-source/rust-toolchain.toml)" --arg channel "$(sed -n 's/^channel = "\([^"]*\)"/\1/p' release-source/rust-toolchain.toml)" --arg rustc "$(rustc -Vv)" --arg cargo "$(cargo -Vv)" --arg contract "$(bash scripts/sha256-file.sh release-source/tools/release-contract.json)" --arg workflow_sha "${{ github.workflow_sha }}" --arg tag "$TAG" --argjson release_id "$RELEASE_ID" --arg schema "$(bash scripts/sha256-file.sh release-source/tools/dist-manifest.schema.json)" --argjson runners "$runners" --argjson recipe "$recipe_sha" '{publishable:$publishable,repository:$repository,sourceSha:$source,cargoVersion:$version,cargoLockSha256:$lock,rustToolchain:{fileSha256:$toolchain,channel:$channel,rustcVv:$rustc,cargoVv:$cargo},releaseContractSha256:$contract,workflow:{name:"Release Recovery",runId:${{ github.run_id }},runAttempt:${{ github.run_attempt }},workflowSha:$workflow_sha},dist:{version:"0.32.0",manifestSchemaSha256:$schema},runners:$runners,tag:$tag,peeledTagSha:$source,releaseId:$release_id,pullRequest:null,recovery:{controlWorkflowSha:$workflow_sha,recipeSha256:$recipe}}' >identity.json
           RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" bash scripts/assemble-official-candidate.sh release-source/target/distrib identity.json dist-manifest.json candidate
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: candidate/codex-warp-release-metadata.json}
@@ -306,7 +306,7 @@ jobs:
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --argjson id "$RELEASE_ID" --argjson run "$ORIGIN_RUN_ID" --argjson attempt "$ORIGIN_RUN_ATTEMPT" '.tag == $tag and .sourceSha == $sha and .releaseId == $id and .workflow.runId == $run and .workflow.runAttempt == $attempt' candidate/codex-warp-release-metadata.json >/dev/null
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
           for subject in candidate/*.tar.xz candidate/*.zip candidate/codex-warp-release-metadata.json; do bash scripts/verify-official-attestation.sh "$subject" candidate/codex-warp-release-metadata.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   load-remote:
@@ -356,7 +356,7 @@ jobs:
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --argjson id "$RELEASE_ID" '.tag == $tag and .sourceSha == $sha and .releaseId == $id' candidate/codex-warp-release-metadata.json >/dev/null
           for subject in candidate/*.tar.xz candidate/*.zip candidate/codex-warp-release-metadata.json; do bash scripts/verify-official-attestation.sh "$subject" candidate/codex-warp-release-metadata.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   mutate:
@@ -443,7 +443,7 @@ jobs:
           jq -s '.' candidate-assets.jsonl >candidate-assets.json
           jq -n --arg operation "$OPERATION" --arg tag "$TAG" --arg source "$SOURCE_SHA" --argjson release_id "$RELEASE_ID" --arg workflow "${{ github.workflow_sha }}" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" --argjson existing "$(cat existing.json)" --argjson expected "$(cat candidate-assets.json)" --arg plan "$(bash scripts/sha256-file.sh retained-plan/official-recovery-plan.json)" --argjson recipe "$recipe_sha" '{schemaVersion:1,operation:$operation,tag:$tag,sourceSha:$source,releaseId:$release_id,controlWorkflowSha:$workflow,runId:$run,runAttempt:$attempt,planSha256:$plan,recipeSha256:$recipe,existingAssets:$existing,expectedAssets:$expected,expectedInventory:[$expected[].name],deleteAssetIds:[$existing[]|select(.matches|not)|.id]}' >official-recovery-intent.json
           echo "delete_count=$(jq '.deleteAssetIds|length' official-recovery-intent.json)" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-intent, path: official-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: official-recovery-intent.json}
@@ -481,7 +481,7 @@ jobs:
           remaining="$(gh api --paginate "repos/${{ github.repository }}/releases/$RELEASE_ID/assets" | jq -sc '[.[][] | .id]')"
           while IFS= read -r id; do jq -e --argjson id "$id" 'index($id)==null' <<<"$remaining" >/dev/null; done < <(jq -r '.deleteAssetIds[]' official-recovery-intent.json)
           jq -n --arg intent "$(bash scripts/sha256-file.sh official-recovery-intent.json)" --argjson ids "$(jq '.deleteAssetIds' official-recovery-intent.json)" --argjson run "${{ github.run_id }}" '{schemaVersion:1,intentSha256:$intent,deletedAssetIds:$ids,runId:$run}' >official-recovery-delete-receipt.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0'
         with: {name: official-recovery-delete-receipt, path: official-recovery-delete-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d74c06f..02f3a16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,7 +74,7 @@ jobs:
         shell: bash
         run: bash scripts/install-pinned-dist.sh
       - name: Cache dist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -90,7 +90,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -196,7 +196,7 @@ jobs:
             --arg cargo "$(cargo -Vv)" \
             '{target:$target,runnerLabel:$label,runnerImage:$image,nativeTools:{observed:$native},rustcVv:$rustc,cargoVv:$cargo}' >"$evidence"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
@@ -244,7 +244,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-global
           path: |
@@ -304,7 +304,7 @@ jobs:
       - name: Assemble and validate exact proof asset set
         shell: bash
         run: bash scripts/assemble-pr-upload-proof.sh target/distrib identity.json pr-upload-proof
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-upload-proof-candidate
           path: pr-upload-proof/
@@ -427,7 +427,7 @@ jobs:
         run: |
           bash scripts/assemble-official-candidate.sh target/distrib identity.json dist-manifest.json release-assets
           SOURCE_DIR="$PWD" bash scripts/check-release-contract.sh official-publication release-assets release-assets/codex-warp-release-metadata.json release-assets/dist-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-release-candidate
           path: release-assets/
diff --git a/dist-workspace.toml b/dist-workspace.toml
index a251ae6..a6312eb 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -32,7 +32,7 @@ x86_64-pc-windows-msvc = "windows-2025"
 
 [dist.github-action-commits]
 "actions/checkout" = "3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
-"actions/upload-artifact" = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+"actions/upload-artifact" = "cf430e030ddbb5b0abf93d22962f4752f3646cd9" # v7.0.2
 "actions/download-artifact" = "9000827ccba6bdab643e8b6fd33ac0654aef8333" # v8.0.2
 "actions/attest-build-provenance" = "4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2
 "actions/attest" = "1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2
diff --git a/tools/release-please-policy/patch-dist-workflow.mjs b/tools/release-please-policy/patch-dist-workflow.mjs
index 61676b3..df19b72 100644
--- a/tools/release-please-policy/patch-dist-workflow.mjs
+++ b/tools/release-please-policy/patch-dist-workflow.mjs
@@ -133,7 +133,7 @@ if (source.includes('uses: actions/attest@v4')) {
 }
 replaceOnce(
   `      - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-local-\${{ join(matrix.targets, '_') }}
           path: |
@@ -153,7 +153,7 @@ replaceOnce(
             --arg cargo "$(cargo -Vv)" \\
             '{target:$target,runnerLabel:$label,runnerImage:$image,nativeTools:{observed:$native},rustcVv:$rustc,cargoVv:$cargo}' >"$evidence"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-local-\${{ join(matrix.targets, '_') }}
           path: |
@@ -219,7 +219,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
       - name: Assemble and validate exact proof asset set
         shell: bash
         run: bash scripts/assemble-pr-upload-proof.sh target/distrib identity.json pr-upload-proof
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-upload-proof-candidate
           path: pr-upload-proof/
@@ -342,7 +342,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
         run: |
           bash scripts/assemble-official-candidate.sh target/distrib identity.json dist-manifest.json release-assets
           SOURCE_DIR="$PWD" bash scripts/check-release-contract.sh official-publication release-assets release-assets/codex-warp-release-metadata.json release-assets/dist-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-release-candidate
           path: release-assets/
diff --git a/tools/release-tooling.json b/tools/release-tooling.json
index a8e6af7..f530703 100644
--- a/tools/release-tooling.json
+++ b/tools/release-tooling.json
@@ -19,7 +19,7 @@
   "actions": {
     "checkout": "3d3c42e5aac5ba805825da76410c181273ba90b1",
     "setupNode": "949feb2413d6458794dcd2491c4babbbce0c15c1",
-    "uploadArtifact": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
+    "uploadArtifact": "cf430e030ddbb5b0abf93d22962f4752f3646cd9",
     "downloadArtifact": "9000827ccba6bdab643e8b6fd33ac0654aef8333",
     "attest": "1e69f48acb82d1966a394da916b4c1698aa569d6",
     "attestBuildProvenance": "4d101475d8b20a2381f78447822ac1eab6504dd8",