diff --git a/.github/workflows/dependency-review-comment.yml b/.github/workflows/dependency-review-comment.yml
index 7394055..001639f 100644
--- a/.github/workflows/dependency-review-comment.yml
+++ b/.github/workflows/dependency-review-comment.yml
@@ -36,7 +36,7 @@ jobs:
           cache: false
 
       - name: Download artifact from the triggering run only
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: behaviorlock-review-${{ github.event.workflow_run.id }}
           path: ${{ runner.temp }}/behaviorlock-review
diff --git a/.github/workflows/release-proofs.yml b/.github/workflows/release-proofs.yml
index 0035d36..d180726 100644
--- a/.github/workflows/release-proofs.yml
+++ b/.github/workflows/release-proofs.yml
@@ -86,7 +86,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Download same-run data-only proof ledger
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: protected-proof-ledger-${{ github.sha }}
           path: proof-input