diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b2d7c62..5da3ffc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -38,7 +38,7 @@ jobs:
         run: bin/package "${{ inputs.version }}" --target macos --yjit --output rubies
 
       - name: Upload portable Ruby
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ruby-${{ inputs.version }}-macos-yjit-true
           path: rubies/
@@ -135,7 +135,7 @@ jobs:
             '
 
       - name: Upload portable Ruby
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ruby-${{ inputs.version }}-${{ matrix.target }}-yjit-${{ matrix.yjit }}
           path: rubies/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fe43e2c..0c86997 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
       hashes: ${{ steps.combine.outputs.hashes }}
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: ruby-${{ inputs.version }}-*
           path: rubies
@@ -204,7 +204,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: ruby-${{ inputs.version }}-*
           path: rubies
@@ -220,7 +220,7 @@ jobs:
           gh release upload "${REVISION_TAG}" *.tar.gz --clobber --repo "${{ github.repository }}"
 
       - name: Download SLSA provenance
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: "ruby-${{ inputs.version }}.intoto.jsonl"
           path: provenance