diff --git a/.github/workflows/ci-impl.yml b/.github/workflows/ci-impl.yml
index d68fb458..c5c01c62 100644
--- a/.github/workflows/ci-impl.yml
+++ b/.github/workflows/ci-impl.yml
@@ -47,7 +47,7 @@ jobs:
             exit 1
           fi
       - run: cargo nextest run
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pitchfork-debug
           path: target/debug/pitchfork
@@ -70,7 +70,7 @@ jobs:
       - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           cache: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pitchfork-debug
           path: target/debug
@@ -115,7 +115,7 @@ jobs:
       - name: Run clippy
         shell: bash
         run: cargo clippy --all-targets --all-features -- -D warnings
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pitchfork-windows
           path: target/debug/pitchfork.exe
@@ -136,7 +136,7 @@ jobs:
         with:
           submodules: true
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pitchfork-windows
           path: target/debug
diff --git a/.github/workflows/comment-release-fixes.yml b/.github/workflows/comment-release-fixes.yml
new file mode 100644
index 00000000..9ee6b77e
--- /dev/null
+++ b/.github/workflows/comment-release-fixes.yml
@@ -0,0 +1,24 @@
+name: comment release fixes
+on:
+  {
+    release: { types: [published] },
+    workflow_dispatch:
+      {
+        inputs:
+          {
+            tag: { required: true, type: string },
+            dry_run: { required: false, type: boolean, default: true },
+          },
+      },
+  }
+jobs:
+  comment:
+    permissions:
+      { contents: read, pull-requests: read, issues: write, discussions: write }
+    uses: jdx/workflows/.github/workflows/comment-release-fixes.yml@4c952564543dd54d60f15ef4062af7fb60c5561d # v1.1.0
+    with:
+      {
+        tag: "${{ inputs.tag || github.event.release.tag_name }}",
+        marker_prefix: pitchfork-fixed-in,
+        dry_run: "${{ inputs.dry_run || false }}",
+      }
diff --git a/.github/workflows/perf-pr.yml b/.github/workflows/perf-pr.yml
index 610a72b4..dda2215d 100644
--- a/.github/workflows/perf-pr.yml
+++ b/.github/workflows/perf-pr.yml
@@ -188,7 +188,7 @@ jobs:
           cp /tmp/tak-gate-status /tmp/tak-out/status 2>/dev/null || echo 2 > /tmp/tak-out/status
           printf '%s %s\n' "${HEAD_SHA:0:12}" "${BASE_SHA:0:12}" > /tmp/tak-out/shas
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: tak-report
@@ -209,7 +209,7 @@ jobs:
       checks: write # attach the regression gate to the measured PR head SHA
       pull-requests: write # the sticky comment, and nothing else
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: tak-report
           path: /tmp/tak-out
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 5c16e86c..d4f4c4f0 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -92,7 +92,7 @@ jobs:
           git notes --ref=tak show HEAD > /tmp/tak-out/note
           git rev-parse HEAD > /tmp/tak-out/sha
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: github.ref == 'refs/heads/main'
         with:
           name: tak-measurement
@@ -112,7 +112,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: tak-measurement
           path: /tmp/tak-out