diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
index 1ac73bb..63a8678 100644
--- a/.github/workflows/release-provenance.yml
+++ b/.github/workflows/release-provenance.yml
@@ -215,7 +215,7 @@ jobs:
           pip install -c requirements.lock -e "."
 
       - name: Download provenance package (no producer tree reuse)
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pcs-core-release-provenance
           path: /tmp/pcs-provenance-dl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8773bb0..9b1670a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -559,7 +559,7 @@ jobs:
           cd python
           pip install -c requirements.lock -e "."
       - name: Download release artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pcs-core-release-bundle-${{ needs.unified-release-gate.outputs.release_mode }}
           path: /tmp/pcs-release