diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44ea9bc5756..e3c3c278b09 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -341,7 +341,7 @@ jobs:
         # resource-profile.json, so merging would clobber all but one.
         # Per-artifact subdirs are exactly what load_resource_profiles walks.
         continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: resource-profile-*
           path: resource-profiles
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2e27ae97262..d9f78283919 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -270,7 +270,7 @@ jobs:
     environment: container-publish
     steps:
       - name: Download digests
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: /tmp/digests
           pattern: digest-*
diff --git a/.github/workflows/js-autofix.yml b/.github/workflows/js-autofix.yml
index eaf4ff26f1b..ebe442b53a2 100644
--- a/.github/workflows/js-autofix.yml
+++ b/.github/workflows/js-autofix.yml
@@ -151,7 +151,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Download patch
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: js-fix-patch
           # ${{ runner.temp }} expands in with: params (shell-style $VAR does not).
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index f90759ea875..a78a657c89b 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -65,7 +65,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Download SARIF result
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: OSV Scanner SARIF file
           path: /tmp/osv-results