diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index d6740ed..a5905b5 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -71,7 +71,7 @@ jobs:
 
     - name: Upload criterion output
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: criterion-output
         path: target/criterion/
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 054091c..bdc20a0 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -54,7 +54,7 @@ jobs:
         rivet-version: v0.3.0
 
     - name: Upload archive
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: compliance-report
         path: ${{ steps.report.outputs.archive-path }}
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index c25a37f..a98dbb3 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -74,7 +74,7 @@ jobs:
 
       - name: Upload crash artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fuzz-artifacts-${{ matrix.target }}
           path: fuzz/artifacts/${{ matrix.target }}/
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload corpus
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fuzz-corpus-${{ matrix.target }}
           path: fuzz/corpus/${{ matrix.target }}/
diff --git a/.github/workflows/memory-profile.yml b/.github/workflows/memory-profile.yml
index 0aa8a7b..1e7507f 100644
--- a/.github/workflows/memory-profile.yml
+++ b/.github/workflows/memory-profile.yml
@@ -64,7 +64,7 @@ jobs:
 
     - name: Upload profiling data
       if: success() || failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: bytehound-profiles
         path: memory-profiling_*.dat
@@ -219,7 +219,7 @@ jobs:
 
     - name: Upload summaries
       if: success() || failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: bytehound-summaries
         path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a09f3b..ff4a9d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,7 +43,7 @@ jobs:
         # fetch-reports can auto-generate data/sigil/{stats,artifacts}.json.
         include-data-formats: true
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       with:
         name: compliance-report
         path: ${{ steps.report.outputs.archive-path }}
@@ -127,7 +127,7 @@ jobs:
     # SHA256SUMS.txt covering every asset — matches the synth release flow.
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ matrix.asset_name }}
         path: artifacts/*
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 0699284..d7c0a7d 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -136,7 +136,7 @@ jobs:
 
     - name: Upload Build Artifacts (Bazel)
       if: matrix.build-system == 'bazel'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: bazel-outputs-${{ matrix.os }}
         path: |
@@ -242,7 +242,7 @@ jobs:
         echo "Verified keyless signature"
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: signed-wasm-artifacts
         path: |
@@ -276,7 +276,7 @@ jobs:
 
     - name: Upload Rekor Data (on failure)
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: rekor-fresh-data
         path: rekor-data.txt
@@ -307,7 +307,7 @@ jobs:
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - name: Upload HTML coverage report
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: coverage-html
         path: coverage-html/
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 7564aea..675fa19 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -137,7 +137,7 @@ jobs:
         echo "All mutants killed!"
     - name: Upload mutants reports
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: mutants-reports
         path: |
diff --git a/.github/workflows/wasm-signing.yml b/.github/workflows/wasm-signing.yml
index 4afdc98..38750ad 100644
--- a/.github/workflows/wasm-signing.yml
+++ b/.github/workflows/wasm-signing.yml
@@ -79,7 +79,7 @@ jobs:
           -i "${{ steps.sign.outputs.signed_path }}"
 
     - name: Upload signed WASM
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: signed-wasm-${{ github.sha }}
         path: ${{ steps.sign.outputs.signed_path }}
@@ -116,7 +116,7 @@ jobs:
       run: wsc bundle inspect -i trust-bundle-${{ github.ref_name }}.json
 
     - name: Upload trust bundle
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: trust-bundle-${{ github.ref_name }}
         path: |