diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d84a94b7..e5034269 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -167,7 +167,7 @@ jobs:
         run: python -m pip install --require-hashes --requirement constraints/dev.txt
 
       - name: Download coverage fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           pattern: coverage-*
           path: coverage-fragments
diff --git a/.github/workflows/release-advisory-verify.yml b/.github/workflows/release-advisory-verify.yml
index 776a7c61..3858b4e5 100644
--- a/.github/workflows/release-advisory-verify.yml
+++ b/.github/workflows/release-advisory-verify.yml
@@ -314,7 +314,7 @@ jobs:
         run: python -m pytest tests/test_adapter_static_only.py -q
 
       - name: Download the shards' evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           pattern: release-suite-evidence-*
           path: suite-evidence
diff --git a/.github/workflows/release-engine-smoke.yml b/.github/workflows/release-engine-smoke.yml
index fc8de9cd..1011fbcf 100644
--- a/.github/workflows/release-engine-smoke.yml
+++ b/.github/workflows/release-engine-smoke.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.12"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: unqualified-engine-wheel
           path: .shipgate-smoke/wheels
diff --git a/.github/workflows/release-preview.yml b/.github/workflows/release-preview.yml
index 59167a42..d32355fc 100644
--- a/.github/workflows/release-preview.yml
+++ b/.github/workflows/release-preview.yml
@@ -285,7 +285,7 @@ jobs:
         # candidate code and reads no candidate text: the release body below
         # is written by this file, at the dispatched revision, and cannot be
         # influenced by anything the build produced.
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: preview-${{ needs.build.outputs.version }}
           path: dist
diff --git a/.github/workflows/release-verify.yml b/.github/workflows/release-verify.yml
index 2e6c4fe5..66244c82 100644
--- a/.github/workflows/release-verify.yml
+++ b/.github/workflows/release-verify.yml
@@ -313,7 +313,7 @@ jobs:
         run: python -m pytest tests/test_adapter_static_only.py -q
 
       - name: Download the shards' evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           pattern: release-suite-evidence-*
           path: suite-evidence
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 031b69f2..153dd64a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -239,7 +239,7 @@ jobs:
           echo "REHEARSAL_RUN_ID=${run_id}" >> "${GITHUB_ENV}"
 
       - name: Download verified candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: ${{ needs.candidate.outputs.artifact_name }}
           path: dist
@@ -491,7 +491,7 @@ jobs:
           fi
 
       - name: Download verified candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: ${{ needs.candidate.outputs.artifact_name }}
           path: dist
@@ -674,13 +674,13 @@ jobs:
           fi
 
       - name: Download verified candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: ${{ needs.candidate.outputs.artifact_name }}
           path: dist
 
       - name: Download signatures
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: release-signatures-${{ needs.candidate.outputs.release_tag }}
           path: signatures