diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index cf7864ec443..fd48ddb06da 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -165,7 +165,7 @@ jobs:
           exit $FAILED
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ocis-build-artifacts
           path: |
@@ -294,7 +294,7 @@ jobs:
 
       - name: Upload raw coverage data
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-coverage-${{ matrix.suite }}
           path: ${{ env.GOCOVERDIR }}
@@ -342,7 +342,7 @@ jobs:
 
       - name: Upload raw coverage data
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-coverage-cli-${{ matrix.suite }}
           path: ${{ env.GOCOVERDIR }}
@@ -390,7 +390,7 @@ jobs:
 
       - name: Upload raw coverage data
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-coverage-ldap-pool-${{ matrix.suite }}
           path: ${{ env.GOCOVERDIR }}
@@ -485,7 +485,7 @@ jobs:
 
       - name: Upload raw coverage data
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-coverage-core-${{ matrix.suite }}
           path: ${{ env.GOCOVERDIR }}
@@ -683,7 +683,7 @@ jobs:
 
       - name: Upload tracing result
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-traces-${{ matrix.suite }}-${{ github.run_attempt }}
           path: web/reports/e2e
@@ -691,7 +691,7 @@ jobs:
 
       - name: Upload a11y result
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-a11y-result-${{ matrix.suite }}-${{ github.run_attempt }}
           path: web/reports/e2e/a11y-report.json
diff --git a/.github/workflows/k8s.yml b/.github/workflows/k8s.yml
index 6eca214af18..f19a090ed55 100644
--- a/.github/workflows/k8s.yml
+++ b/.github/workflows/k8s.yml
@@ -622,7 +622,7 @@ jobs:
 
       - name: Upload Playwright traces
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-traces-${{ matrix.suite }}-k8s-${{ github.run_attempt }}
           path: web/reports/e2e
@@ -630,7 +630,7 @@ jobs:
 
       - name: Upload a11y result
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-a11y-result-${{ matrix.suite }}-k8s-${{ github.run_attempt }}
           path: web/reports/e2e/a11y-report.json
@@ -638,7 +638,7 @@ jobs:
 
       - name: Upload oCIS logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ocis-logs-${{ matrix.suite }}-k8s-${{ github.run_attempt }}
           path: tests/config/k8s/logs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ddb2a652745..442a83f81c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -119,7 +119,7 @@ jobs:
         run: |
           VERSION="${{ needs.determine-release-type.outputs.version }}"
           sed -i "s/LatestTag = \".*\"/LatestTag = \"$VERSION\"/" ocis-pkg/version/version.go
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: generated-code
           path: |
@@ -304,7 +304,7 @@ jobs:
           if [[ "${{ matrix.os }}" == "linux" ]]; then
             cp assets/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf ocis/dist/release/
           fi
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-${{ matrix.os }}
           path: ocis/dist/release/*
@@ -347,7 +347,7 @@ jobs:
       - run: make ci-node-check-licenses && make ci-node-save-licenses
       - run: make ci-go-check-licenses && make ci-go-save-licenses
       - run: tar -czf third-party-licenses.tar.gz -C third-party-licenses .
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: third-party-licenses
           path: third-party-licenses.tar.gz
@@ -371,7 +371,7 @@ jobs:
           if [[ $(wc -l < ocis/dist/CHANGELOG.md) -lt 5 ]]; then
             echo "Development release — no release notes yet. See [unreleased changes](https://github.com/owncloud/ocis/tree/master/changelog/unreleased/)." > ocis/dist/CHANGELOG.md
           fi
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: changelog
           path: ocis/dist/CHANGELOG.md