diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index ffadf16..a3a9322 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Restore cached binaries + stamp
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-cache
           path: .
diff --git a/.github/workflows/build-oci.yaml b/.github/workflows/build-oci.yaml
index cc3ab91..922eaeb 100644
--- a/.github/workflows/build-oci.yaml
+++ b/.github/workflows/build-oci.yaml
@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Restore cached binaries + stamp
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-cache
           path: .
diff --git a/.github/workflows/push-ghcr.yaml b/.github/workflows/push-ghcr.yaml
index 3c59faa..5dbda2c 100644
--- a/.github/workflows/push-ghcr.yaml
+++ b/.github/workflows/push-ghcr.yaml
@@ -24,13 +24,13 @@ jobs:
 
     steps:
       - name: Download amd64 image tarballs
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: images-amd64
           path: amd64
 
       - name: Download arm64 image tarballs
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: images-arm64
           path: arm64
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 51a93bf..89e225e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -52,7 +52,7 @@ jobs:
         run: make inlined-yaml-files
 
       - name: Restore cached binaries
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-cache
           path: .