diff --git a/.github/workflows/ci-long-run.yml b/.github/workflows/ci-long-run.yml
index 91662760..df425334 100644
--- a/.github/workflows/ci-long-run.yml
+++ b/.github/workflows/ci-long-run.yml
@@ -113,7 +113,7 @@ jobs:
             "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/environments/hil-write" \
             | jq -e '.protection_rules | any(.type == "required_reviewers" and (.reviewers | length > 0))' >/dev/null
       - name: Fetch artifact before long execution
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.artifact-name }}
           run-id: ${{ inputs.artifact-run-id }}
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index 4d0b9417..b80719c4 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -50,7 +50,7 @@ jobs:
           test "$(printf '%s' "$run" | jq -r .conclusion)" = success
 
       - name: Download existing candidate assets
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.artifact_name }}
           path: target/candidate-assets
diff --git a/.github/workflows/package-test.yml b/.github/workflows/package-test.yml
index 1f25cd0f..f3ccc8b7 100644
--- a/.github/workflows/package-test.yml
+++ b/.github/workflows/package-test.yml
@@ -70,14 +70,14 @@ jobs:
 
       - name: Download package artifact from current run
         if: ${{ inputs.artifact_run_id == '' }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.artifact_name }}
           path: target/package-stage
 
       - name: Download package artifact from explicit source run
         if: ${{ inputs.artifact_run_id != '' }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.artifact_name }}
           path: target/package-stage
diff --git a/.github/workflows/release-candidate-build.yml b/.github/workflows/release-candidate-build.yml
index 8085eb81..a5e3553e 100644
--- a/.github/workflows/release-candidate-build.yml
+++ b/.github/workflows/release-candidate-build.yml
@@ -243,7 +243,7 @@ jobs:
           rustup default 1.97.1
 
       - name: Download amd64 stage
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: candidate-amd64
           path: target/native/amd64
diff --git a/.github/workflows/release-candidate-finalize.yml b/.github/workflows/release-candidate-finalize.yml
index f231cb2e..2d66e705 100644
--- a/.github/workflows/release-candidate-finalize.yml
+++ b/.github/workflows/release-candidate-finalize.yml
@@ -142,7 +142,7 @@ jobs:
 
       - name: Prepare dry-run product snapshot from explicit source run
         if: ${{ inputs.dry_run }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.product_artifact_name }}
           path: target/finalize/assets
@@ -152,7 +152,7 @@ jobs:
 
       - name: Prepare dry-run gate reports from explicit source run
         if: ${{ inputs.dry_run }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.reports_artifact_name }}
           path: target/finalize/reports
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 1804e895..c7c88459 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -93,7 +93,7 @@ jobs:
         run: sh scripts/release/ensure-runner-tools.sh github
 
       - name: Download protected finalizer approval from explicit source run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: ${{ inputs.finalized_artifact_name }}
           path: target/approved