diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 58ce67ae61..ccbe3066c2 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -200,7 +200,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: npm
@@ -312,7 +312,7 @@ jobs:
 
       - name: Retain bounded native updater receipt
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-updater-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/pulse-native-updater.json
@@ -332,7 +332,7 @@ jobs:
 
       - name: Retain bounded notification runtime receipt
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: notification-runtime-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/pulse-notification-runtime.json
@@ -598,7 +598,7 @@ jobs:
 
       - name: Upload internal/api test timings
         if: always() && needs.changes.outputs.code == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: internal-api-test-seconds-${{ matrix.index }}
           path: ${{ runner.temp }}/internal-api-test-seconds/
@@ -771,7 +771,7 @@ jobs:
 
       - name: Upload benchmark evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bench-results
           path: |
diff --git a/.github/workflows/build-release-candidate.yml b/.github/workflows/build-release-candidate.yml
index 45f219a354..69451028d6 100644
--- a/.github/workflows/build-release-candidate.yml
+++ b/.github/workflows/build-release-candidate.yml
@@ -362,7 +362,7 @@ jobs:
           done
 
       - name: Upload signed macOS binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signed-macos-agent-${{ github.sha }}-${{ inputs.version }}
           path: native-agent-binaries/
@@ -436,7 +436,7 @@ jobs:
 
       - name: Upload legacy signed binaries
         if: ${{ inputs.windows_signing_backend == 'legacy-pfx' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: legacy-signed-windows-agent-${{ github.sha }}-${{ inputs.version }}
           path: unsigned-native-agent-binaries/
@@ -447,7 +447,7 @@ jobs:
       - name: Upload unsigned SignPath input
         if: ${{ inputs.windows_signing_backend == 'signpath' }}
         id: upload-unsigned-windows
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: unsigned-windows-agent-${{ github.sha }}-${{ inputs.version }}
           path: unsigned-native-agent-binaries/
@@ -499,7 +499,7 @@ jobs:
       # re-run against the recorded request days later without a rebuild.
       - name: Upload SignPath signing request record
         if: ${{ inputs.windows_signing_backend == 'signpath' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-signing-request-${{ github.sha }}-${{ inputs.version }}
           path: windows-signing-request.json
@@ -527,14 +527,14 @@ jobs:
 
       - name: Download legacy signed binaries
         if: ${{ inputs.windows_signing_backend == 'legacy-pfx' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: legacy-signed-windows-agent-${{ github.sha }}-${{ inputs.version }}
           path: unsigned-native-agent-binaries
 
       - name: Download SignPath signing request record
         if: ${{ inputs.windows_signing_backend == 'signpath' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-signing-request-${{ github.sha }}-${{ inputs.version }}
           path: windows-signing-request
@@ -640,7 +640,7 @@ jobs:
           python scripts/write_github_output.py signing_backend $validatedBackend
 
       - name: Upload signed Windows binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signed-windows-agent-${{ github.sha }}-${{ inputs.version }}
           path: native-agent-binaries/
@@ -649,7 +649,7 @@ jobs:
           compression-level: 0
 
       - name: Upload Windows signing evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-signing-evidence-${{ github.sha }}-${{ inputs.version }}
           path: windows-signing-evidence.json
@@ -708,7 +708,7 @@ jobs:
           cache: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -854,21 +854,21 @@ jobs:
 
       - name: Download signed macOS binaries
         if: ${{ inputs.require_macos_signing }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: signed-macos-agent-${{ github.sha }}-${{ inputs.version }}
           path: native-agent-binaries
 
       - name: Download signed Windows binaries
         if: ${{ inputs.require_windows_signing }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: signed-windows-agent-${{ github.sha }}-${{ inputs.version }}
           path: native-agent-binaries
 
       - name: Download Windows signing evidence
         if: ${{ inputs.require_windows_signing }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-signing-evidence-${{ github.sha }}-${{ inputs.version }}
           path: release-candidate-manifest
@@ -985,7 +985,7 @@ jobs:
             --output "${payload_root}/release-container-payload.json"
 
       - name: Upload immutable release candidate
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.identity.outputs.artifact_name }}
           path: release/
@@ -995,7 +995,7 @@ jobs:
           overwrite: true
 
       - name: Upload candidate manifest
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.identity.outputs.manifest_artifact_name }}
           path: release-candidate-manifest/
@@ -1004,7 +1004,7 @@ jobs:
           overwrite: true
 
       - name: Upload exact-candidate container payload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.identity.outputs.container_artifact_name }}
           path: ${{ runner.temp }}/release-container-payload/
diff --git a/.github/workflows/canonical-governance.yml b/.github/workflows/canonical-governance.yml
index c8982d77e1..517fdb31cf 100644
--- a/.github/workflows/canonical-governance.yml
+++ b/.github/workflows/canonical-governance.yml
@@ -38,7 +38,7 @@ jobs:
           cache-dependency-path: repos/pulse/go.sum
 
       - name: Set up Node.js for frontend governance
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/canonical-private-governance.yml b/.github/workflows/canonical-private-governance.yml
index a8f7454482..69f5b9b78f 100644
--- a/.github/workflows/canonical-private-governance.yml
+++ b/.github/workflows/canonical-private-governance.yml
@@ -84,7 +84,7 @@ jobs:
             -count=1
 
       - name: Upload Pulse Mobile compatibility evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pulse-mobile-compatibility
           path: ${{ runner.temp }}/pulse-mobile-compatibility.json
diff --git a/.github/workflows/compile-release-payload.yml b/.github/workflows/compile-release-payload.yml
index f59a08da31..6a4e2197c9 100644
--- a/.github/workflows/compile-release-payload.yml
+++ b/.github/workflows/compile-release-payload.yml
@@ -65,7 +65,7 @@ jobs:
           cache: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -97,7 +97,7 @@ jobs:
         run: ./scripts/build-release-binaries.sh "${VERSION}" "$RUNNER_TEMP/release-compiled"
 
       - name: Upload exact-SHA compiled payload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-compiled-${{ inputs.source_sha }}-${{ inputs.version }}-${{ inputs.request_id }}
           path: ${{ runner.temp }}/release-compiled/
@@ -171,7 +171,7 @@ jobs:
             "$RUNNER_TEMP/secure-runtime-qualification/secure-runtime-compiler-provenance.sigstore.json"
 
       - name: Upload hosted qualification packet
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: secure-runtime-qualification-${{ inputs.source_sha }}-${{ inputs.version }}-${{ inputs.request_id }}
           path: ${{ runner.temp }}/secure-runtime-qualification/
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 04739e1458..1328cfddd9 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -447,7 +447,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
@@ -458,7 +458,7 @@ jobs:
         run: npm --prefix frontend-modern run build
 
       - name: Upload frontend bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-frontend-${{ github.sha }}
           path: frontend-modern/dist/
@@ -482,7 +482,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -521,7 +521,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -562,7 +562,7 @@ jobs:
           persist-credentials: false
 
       - name: Download verified frontend bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: frontend-modern/dist
           name: release-frontend-${{ github.sha }}
@@ -601,14 +601,14 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
           cache-dependency-path: 'frontend-modern/package-lock.json'
 
       - name: Download verified frontend bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: frontend-modern/dist
           name: release-frontend-${{ github.sha }}
@@ -719,7 +719,7 @@ jobs:
 
       - name: Upload integration Playwright report
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-integration-playwright-report
           path: tests/integration/playwright-report/
@@ -728,7 +728,7 @@ jobs:
 
       - name: Upload integration failures
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-integration-failures
           path: |
@@ -766,13 +766,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
 
       - name: Download verified frontend bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: frontend-modern/dist
           name: release-frontend-${{ github.sha }}
@@ -839,7 +839,7 @@ jobs:
 
       - name: Upload smoke diagnostics
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-smoke-failures-${{ github.sha }}
           path: |
@@ -886,7 +886,7 @@ jobs:
 
       - name: Upload release-note visual artifact
         if: ${{ needs.prepare.outputs.visual_capture_count != '0' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-note-visuals-${{ github.sha }}
           path: release-note-visuals/*.png
@@ -919,20 +919,20 @@ jobs:
           fetch-depth: 0
 
       - name: Download immutable release candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ needs.build_release_candidate.outputs.artifact_name }}
           path: release
 
       - name: Download release candidate manifest
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ needs.build_release_candidate.outputs.manifest_artifact_name }}
           path: release-candidate-manifest
 
       - name: Download release-note visuals
         if: ${{ needs.prepare.outputs.visual_capture_count != '0' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-note-visuals-${{ github.sha }}
           path: release-note-visuals
diff --git a/.github/workflows/demo-runtime-native.yml b/.github/workflows/demo-runtime-native.yml
index a8928e5e5b..cbdf441eb0 100644
--- a/.github/workflows/demo-runtime-native.yml
+++ b/.github/workflows/demo-runtime-native.yml
@@ -35,7 +35,7 @@ jobs:
         run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT,GITHUB_SHA,GITHUB_RUN_ID,GITHUB_RUN_ATTEMPT python3 .github/scripts/tests/demo_runtime_native.py
       - name: Retain sanitised terminal receipts and cleanup
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: demo-native-${{ github.run_id }}
           path: demo-native-result.json
diff --git a/.github/workflows/dependency-advisory-watch.yml b/.github/workflows/dependency-advisory-watch.yml
index 9d1ff58a42..60d211061e 100644
--- a/.github/workflows/dependency-advisory-watch.yml
+++ b/.github/workflows/dependency-advisory-watch.yml
@@ -53,7 +53,7 @@ jobs:
       # package from main is fetched or run. The runner always comes from
       # this workflow's own commit, never the fetched main source.
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           # setup-node enables npm caching by itself once package.json names
diff --git a/.github/workflows/eval-model-matrix.yml b/.github/workflows/eval-model-matrix.yml
index 6f73937992..5f54a280d9 100644
--- a/.github/workflows/eval-model-matrix.yml
+++ b/.github/workflows/eval-model-matrix.yml
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload eval reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: eval-reports
           path: tmp/eval-reports
diff --git a/.github/workflows/provider-msp-startup.yml b/.github/workflows/provider-msp-startup.yml
index 3de7097251..39a6209314 100644
--- a/.github/workflows/provider-msp-startup.yml
+++ b/.github/workflows/provider-msp-startup.yml
@@ -57,7 +57,7 @@ jobs:
           cache: true
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index 4a851fb20c..2ebeb4919b 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -100,7 +100,7 @@ jobs:
           test "$(tr -d '\n\r[:space:]' < VERSION)" = "${EXPECTED_VERSION}"
 
       - name: Download exact-candidate container payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.container_artifact }}
           path: ${{ runner.temp }}/release-container-payload
diff --git a/.github/workflows/publish-helm-chart.yml b/.github/workflows/publish-helm-chart.yml
index 632e780619..1939a56f1e 100644
--- a/.github/workflows/publish-helm-chart.yml
+++ b/.github/workflows/publish-helm-chart.yml
@@ -159,7 +159,7 @@ jobs:
             --destination dist
 
       - name: Upload packaged chart artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pulse-chart-${{ steps.versions.outputs.chart_version }}
           path: dist/pulse-${{ steps.versions.outputs.chart_version }}.tgz
diff --git a/.github/workflows/qualify-browser-update-release.yml b/.github/workflows/qualify-browser-update-release.yml
index cf79766ba5..6561b93627 100644
--- a/.github/workflows/qualify-browser-update-release.yml
+++ b/.github/workflows/qualify-browser-update-release.yml
@@ -98,7 +98,7 @@ jobs:
             --from-commit "$FROM_COMMIT" --to-commit "$TO_COMMIT" --tag "$TAG" \
             --archives "$root" --output "$root/packet.json"
       - name: Prepare pinned browser without lifecycle hooks
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -158,7 +158,7 @@ jobs:
         run: tailscale serve reset
       - name: Retain bounded identity and terminal receipts, never credentials
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: browser-release-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/qualify-release-containers.yml b/.github/workflows/qualify-release-containers.yml
index 77f25a7cc7..66da3b1d3f 100644
--- a/.github/workflows/qualify-release-containers.yml
+++ b/.github/workflows/qualify-release-containers.yml
@@ -40,7 +40,7 @@ jobs:
         run: test "$(git rev-parse HEAD)" = "${EXPECTED_SOURCE_SHA}"
 
       - name: Download exact-candidate container payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.container_artifact }}
           path: ${{ runner.temp }}/release-container-payload
diff --git a/.github/workflows/qualify-secure-runtime-release.yml b/.github/workflows/qualify-secure-runtime-release.yml
index 659aa475e1..96b654ad8f 100644
--- a/.github/workflows/qualify-secure-runtime-release.yml
+++ b/.github/workflows/qualify-secure-runtime-release.yml
@@ -394,7 +394,7 @@ jobs:
 
       - name: Upload immutable RC qualification evidence
         if: ${{ success() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: secure-runtime-qualification-${{ steps.release.outputs.tag }}-${{ steps.source.outputs.commit }}
           path: |
diff --git a/.github/workflows/recover-demo-server.yml b/.github/workflows/recover-demo-server.yml
index 5e6b0f37b8..079f38c9c6 100644
--- a/.github/workflows/recover-demo-server.yml
+++ b/.github/workflows/recover-demo-server.yml
@@ -199,7 +199,7 @@ jobs:
 
       - name: Retain bounded recovery evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: stable-demo-runtime-recovery-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml
index 0789d377a3..417bc07727 100644
--- a/.github/workflows/release-dry-run.yml
+++ b/.github/workflows/release-dry-run.yml
@@ -374,7 +374,7 @@ jobs:
             --github-annotations
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -490,7 +490,7 @@ jobs:
 
       - name: Upload integration diagnostic evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-dry-run-integration-diagnostics
           path: |
@@ -628,7 +628,7 @@ jobs:
 
       - name: Upload rehearsal summary artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.summary.outputs.artifact_name }}
           path: ${{ steps.summary.outputs.summary_file }}
diff --git a/.github/workflows/repo-boundary-audit.yml b/.github/workflows/repo-boundary-audit.yml
index 02dce6acf1..47d8b05362 100644
--- a/.github/workflows/repo-boundary-audit.yml
+++ b/.github/workflows/repo-boundary-audit.yml
@@ -48,7 +48,7 @@ jobs:
         run: ./scripts/audit-private-boundary.sh --enforce
 
       - name: Upload Audit Report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: repo-boundary-audit
           path: repo-boundary-audit.txt
diff --git a/.github/workflows/root-pair-diagnostic.yml b/.github/workflows/root-pair-diagnostic.yml
index 5e52b49d6f..1ed5af6347 100644
--- a/.github/workflows/root-pair-diagnostic.yml
+++ b/.github/workflows/root-pair-diagnostic.yml
@@ -41,7 +41,7 @@ jobs:
         run: python3 scripts/diagnose-root-pair.py --output root-pair-evidence
       - name: Retain partial or complete diagnostic evidence only
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: root-pair-diagnostic-${{ github.run_id }}-${{ github.run_attempt }}
           path: root-pair-evidence/
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index c7862e486e..3676069206 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -358,7 +358,7 @@ jobs:
 
       - name: Retain continuity evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-continuity-${{ steps.release.outputs.tag || 'unresolved' }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: release-continuity-evidence
@@ -439,7 +439,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
 
diff --git a/.github/workflows/signpath-test-signing.yml b/.github/workflows/signpath-test-signing.yml
index ab712b160f..f30f943b14 100644
--- a/.github/workflows/signpath-test-signing.yml
+++ b/.github/workflows/signpath-test-signing.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Upload unsigned SignPath test input
         id: upload-unsigned-windows
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: unsigned-signpath-test-${{ github.sha }}-${{ inputs.version }}
           path: unsigned-native-agent-binaries/
@@ -319,7 +319,7 @@ jobs:
           }
 
       - name: Upload non-production evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signpath-test-signing-evidence-${{ github.sha }}-${{ inputs.version }}
           path: signpath-test-signing-evidence.json
diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
index dc865f1665..6449d3f0e4 100644
--- a/.github/workflows/test-e2e.yml
+++ b/.github/workflows/test-e2e.yml
@@ -73,7 +73,7 @@ jobs:
         run: python3 scripts/tests/test_playwright_acquisition.py
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -116,7 +116,7 @@ jobs:
         run: python3 scripts/check_docs_mirror.py
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -160,7 +160,7 @@ jobs:
           --grep 'Scenario 1:|create, update, member manage' --workers=1 --retries=0
       - name: Upload offline provisioning failure report
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: offline-org-provisioning-report
           path: tests/integration/playwright-report/multi-tenant-diagnostic/
@@ -188,7 +188,7 @@ jobs:
 
       - name: Upload this run's exact test images
         id: images
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-test-images-${{ github.sha }}-${{ github.run_attempt }}
           path: |
@@ -218,7 +218,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -246,7 +246,7 @@ jobs:
         run: npm ci
 
       - name: Download this run's exact test images
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.test-images.outputs.artifact-id }}
           path: ${{ runner.temp }}/pulse-e2e-images
@@ -280,7 +280,7 @@ jobs:
 
       - name: Upload failed fixture admission
         if: ${{ !cancelled() && steps.fixture.outcome == 'failure' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fixture-readiness-shard-${{ matrix.shard }}
           path: |
@@ -319,7 +319,7 @@ jobs:
       # reach the job deadline. Probation must not take its receipts with it.
       - name: Upload Playwright report
         if: ${{ !cancelled() && steps.stable.outcome == 'failure' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-shard-${{ matrix.shard }}
           path: tests/integration/playwright-report/
@@ -329,7 +329,7 @@ jobs:
       # Keep only the separate machine-readable result here.
       - name: Upload JUnit results
         if: ${{ !cancelled() && steps.stable.outcome == 'failure' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: junit-results-shard-${{ matrix.shard }}
           path: tests/integration/test-results/junit.xml
@@ -384,7 +384,7 @@ jobs:
       # the combined Actions log stays small enough to inspect its verdicts.
       - name: Upload complete container diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-container-logs-shard-${{ matrix.shard }}-${{ github.sha }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/pulse-e2e-container-logs/
@@ -395,7 +395,7 @@ jobs:
       # failure() never fires for these; key off the step outcome instead.
       - name: Upload probation Playwright report
         if: ${{ !cancelled() && steps.probation.outcome == 'failure' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-probation-shard-${{ matrix.shard }}
           path: tests/integration/playwright-report-probation/
@@ -403,7 +403,7 @@ jobs:
 
       - name: Upload probation JUnit results
         if: ${{ !cancelled() && steps.probation.outcome == 'failure' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: junit-results-probation-shard-${{ matrix.shard }}
           path: tests/integration/test-results-probation/junit.xml
@@ -428,7 +428,7 @@ jobs:
         run: python3 scripts/check_docs_mirror.py
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -450,7 +450,7 @@ jobs:
         run: npm ci
 
       - name: Download this run's exact test images
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.test-images.outputs.artifact-id }}
           path: ${{ runner.temp }}/pulse-e2e-images
@@ -490,7 +490,7 @@ jobs:
 
       - name: Upload complete container diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-container-logs-agent-registration-${{ github.sha }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/pulse-e2e-container-logs/
@@ -499,7 +499,7 @@ jobs:
 
       - name: Upload Playwright report
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-agent-registration
           path: tests/integration/playwright-report/
@@ -507,7 +507,7 @@ jobs:
 
       - name: Upload test videos and screenshots
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-failures-agent-registration
           path: tests/integration/test-results/
diff --git a/.github/workflows/unified-agent-native.yml b/.github/workflows/unified-agent-native.yml
index ee3ce15c3e..4966b0f0e0 100644
--- a/.github/workflows/unified-agent-native.yml
+++ b/.github/workflows/unified-agent-native.yml
@@ -128,7 +128,7 @@ jobs:
 
       - name: Retain bounded native agent removal receipt
         if: always() && runner.os == 'Linux'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-agent-removal-${{ matrix.runner }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/pulse-agent-removal.json
@@ -149,7 +149,7 @@ jobs:
         run: go test -count=1 -timeout 3m -run '^TestIntegrationContainer' ./scripts/installtests
 
       - name: Set up Node.js for native runtime test assets
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           cache: 'npm'
diff --git a/.github/workflows/update-demo-server.yml b/.github/workflows/update-demo-server.yml
index f39ac182d0..aff887cafb 100644
--- a/.github/workflows/update-demo-server.yml
+++ b/.github/workflows/update-demo-server.yml
@@ -485,7 +485,7 @@ jobs:
 
       - name: Retain guarded demo transaction evidence
         if: always() && inputs.verify_only != true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: stable-demo-transaction-${{ github.run_id }}
           path: demo-runtime-transaction.json
diff --git a/.github/workflows/uuid-layout-diagnostic.yml b/.github/workflows/uuid-layout-diagnostic.yml
index 0a160849fb..c44a2e3166 100644
--- a/.github/workflows/uuid-layout-diagnostic.yml
+++ b/.github/workflows/uuid-layout-diagnostic.yml
@@ -41,7 +41,7 @@ jobs:
         run: python3 scripts/diagnose-uuid-layout.py --output uuid-layout-evidence
       - name: Retain partial or complete diagnostic evidence only
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: uuid-layout-diagnostic-${{ github.run_id }}-${{ github.run_attempt }}
           path: uuid-layout-evidence/
diff --git a/.github/workflows/validate-release-assets.yml b/.github/workflows/validate-release-assets.yml
index c21f99cc81..6b13ab1499 100644
--- a/.github/workflows/validate-release-assets.yml
+++ b/.github/workflows/validate-release-assets.yml
@@ -204,7 +204,7 @@ jobs:
 
       - name: Download immutable candidate manifest
         if: steps.context.outputs.should_run == 'true' && steps.body_integrity.outcome == 'success' && inputs.candidate_manifest_artifact != ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.candidate_manifest_artifact }}
           path: release-candidate-manifest