diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 854d50240..ac2b4686a 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -45,14 +45,14 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download benchmark history artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: benchmark-files
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download benchmark JSON results
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: benchmark-results-json
           run-id: ${{ github.event.workflow_run.id }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1331d39..9594fca80 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -201,7 +201,7 @@ jobs:
 
       - name: Download PR-built native addon
         if: needs.native-host-build.result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: native-host-${{ matrix.os }}
           path: crates/codegraph-core
@@ -334,7 +334,7 @@ jobs:
 
       - name: Download PR-built native addon
         if: needs.native-host-build.result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: native-host-${{ matrix.os }}
           path: crates/codegraph-core
@@ -487,7 +487,7 @@ jobs:
 
       - name: Download PR-built native addon
         if: needs.native-host-build.result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: native-host-ubuntu-latest
           path: crates/codegraph-core/
diff --git a/.github/workflows/codegraph-impact-comment.yml b/.github/workflows/codegraph-impact-comment.yml
index 343b36b53..2be9d9c0b 100644
--- a/.github/workflows/codegraph-impact-comment.yml
+++ b/.github/workflows/codegraph-impact-comment.yml
@@ -28,7 +28,7 @@ jobs:
     if: github.event.workflow_run.conclusion == 'success'
     steps:
       - name: Download impact artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codegraph-impact
           run-id: ${{ github.event.workflow_run.id }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7f7b1db12..2873c0d0c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -232,7 +232,7 @@ jobs:
           cache: false
 
       - name: Download native artifact (linux-x64)
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: native-linux-x64
           path: crates/codegraph-core/
@@ -399,7 +399,7 @@ jobs:
         run: npm pkg delete scripts.prepublishOnly
 
       - name: Download native artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: ${{ runner.temp }}/artifacts/
 
@@ -581,7 +581,7 @@ jobs:
         run: npm pkg delete scripts.prepublishOnly
 
       - name: Download native artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: ${{ runner.temp }}/artifacts/