diff --git a/.github/workflows/collaboration-webhook-notifications.yml b/.github/workflows/collaboration-webhook-notifications.yml
index bd67756..f24ee56 100644
--- a/.github/workflows/collaboration-webhook-notifications.yml
+++ b/.github/workflows/collaboration-webhook-notifications.yml
@@ -137,7 +137,7 @@ jobs:
 
       - name: Upload validation artifacts (retention >= 90 days)
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: webhook-validation-github-${{ github.run_id }}
           path: .tmp/webhook-validation/
diff --git a/.github/workflows/supply-chain-security.yml b/.github/workflows/supply-chain-security.yml
index d286036..6aa9def 100644
--- a/.github/workflows/supply-chain-security.yml
+++ b/.github/workflows/supply-chain-security.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Upload supply-chain evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: supply-chain-security-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.baseline.outputs.output_directory }}