diff --git a/action.yml b/action.yml
index de871fa..6ceee5b 100644
--- a/action.yml
+++ b/action.yml
@@ -611,7 +611,7 @@ runs:
     - name: Upload terraform artifacts
       if: steps.safety.outputs.should_deploy == 'true'
       continue-on-error: true
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: terraform-artifacts-${{ steps.resolve-env.outputs.environment }}
         path: terraform/plans
@@ -777,7 +777,7 @@ runs:
     - name: Upload terraform plans
       if: steps.plan-summary.outputs.has_changes == 'true'
       continue-on-error: true
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: terraform-plans-${{ steps.resolve-env.outputs.environment }}
         path: terraform/plans/*.tfplan
diff --git a/tests/run-merge-tests.sh b/tests/run-merge-tests.sh
index b579fa1..93eb463 100755
--- a/tests/run-merge-tests.sh
+++ b/tests/run-merge-tests.sh
@@ -107,8 +107,8 @@ assert_eq "$(yq -r '.inputs | has("gcp_service_account")' "$PROJECT_ROOT/action.
 assert_eq "$(yq -r '.inputs | has("aws_role_arn")' "$PROJECT_ROOT/action.yml")" "false" "AWS role input is not accepted"
 assert_eq "$(yq -r '.inputs | has("aws_region")' "$PROJECT_ROOT/action.yml")" "false" "AWS region input is not accepted"
 assert_eq "$(yq -r '.inputs.state_backend.required' "$PROJECT_ROOT/action.yml")" "false" "State backend input is optional"
-assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v6" "Artifact upload uses Node.js 24 action runtime"
-assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v6" "Plan upload uses Node.js 24 action runtime"
+assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Artifact upload uses upload-artifact v7"
+assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Plan upload uses upload-artifact v7"
 assert_eq "$(yq -r '[.runs.steps[] | select(.uses == "google-github-actions/auth@v3" or .uses == "aws-actions/configure-aws-credentials@v6")] | length' "$PROJECT_ROOT/action.yml")" "0" "Action does not configure cloud credentials"
 assert_eq "$(grep -c 'Authenticate with Google Cloud before invoking github-rabbit-action' "$PROJECT_ROOT/action.yml")" "1" "Action requires caller-provided GCP credentials"
 assert_eq "$(grep -c 'AWS credentials configured by the caller workflow' "$PROJECT_ROOT/action.yml")" "1" "Action forwards caller AWS credentials"