diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index 31bcfc4..7eb293f 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -51,7 +51,7 @@ jobs:
 
       - name: Upload corpus
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: fuzz-corpus-${{ matrix.sanitizer }}
           path: build/corpus
diff --git a/.github/workflows/compilation_tests.yml b/.github/workflows/compilation_tests.yml
index 01b3e76..9ea3a7e 100644
--- a/.github/workflows/compilation_tests.yml
+++ b/.github/workflows/compilation_tests.yml
@@ -252,7 +252,7 @@ jobs:
         run: cargo build --release --target ${{ matrix.target }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}
           path: impl/rust-cli/target/${{ matrix.target }}/release/vsh${{ matrix.os == 'windows-latest' && '.exe' || '' }}
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index cd0dcf3..83f22cf 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2
+        uses: erlef/setup-beam@3580539ceec3dc05b0ed51e9e10b08eb7a7c2bb4 # v1.18.2
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
@@ -75,7 +75,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@47309c993abb98030a35d55ef7ff34b7fa1074b5 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v4
         with:
           name: hypatia-findings
           path: hypatia-findings.json
diff --git a/.github/workflows/lean-verification.yml b/.github/workflows/lean-verification.yml
index e0bc68e..2878df7 100644
--- a/.github/workflows/lean-verification.yml
+++ b/.github/workflows/lean-verification.yml
@@ -115,7 +115,7 @@ jobs:
           # Note: with-lean binary would be in different target dir, skip for now
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: lean-extraction-artifacts
           path: |
@@ -172,7 +172,7 @@ jobs:
           cargo bench --bench lean_verification_overhead -- --baseline baseline
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark-results
           path: impl/rust-cli/target/criterion/
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 27e9c24..7a548a3 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -32,7 +32,7 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@4054fa83a075fdf090bd098bdb1c09aaf64a4169 # main
+        uses: editorconfig-checker/action-editorconfig-checker@1a8ea00bde2ec25afe074a2cdc15b1fd7fb60a39 # main
         continue-on-error: true
 
   docs:
diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index e605083..16f2d1a 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Upload validation report
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: validation-report
           path: validation-report.md