diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index af90e0c..2c453c2 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Upload SBOM
         if: always()
         continue-on-error: true # informational artifact; must never block the blocking scan above
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
         with:
           name: sbom-cyclonedx
           path: sbom.cdx.json
@@ -86,7 +86,7 @@ jobs:
         run: |
           pnpm licenses list --json > licenses.json || true
           pnpm licenses list
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
         continue-on-error: true # informational artifact; must never block CI
         with:
           name: license-inventory