diff --git a/.github/workflows/build-image-bundle.yml b/.github/workflows/build-image-bundle.yml
index a62998841d44..6350545bac93 100644
--- a/.github/workflows/build-image-bundle.yml
+++ b/.github/workflows/build-image-bundle.yml
@@ -41,12 +41,12 @@ jobs:
           persist-credentials: false
 
       - name: "Download :: k0s"
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-amd64
 
       - name: "Download :: Image list"
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ inputs.image-bundle-name }}-image-list-${{ inputs.target-os }}-${{ inputs.target-arch }}
 
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 3a079c41587f..f6be48a104b1 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -145,7 +145,7 @@ jobs:
 
     steps:
       - name: Download
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sbom-linux-amd64
 
diff --git a/.github/workflows/ostests-e2e.yaml b/.github/workflows/ostests-e2e.yaml
index fade44d27ff4..dbad01739a18 100644
--- a/.github/workflows/ostests-e2e.yaml
+++ b/.github/workflows/ostests-e2e.yaml
@@ -96,7 +96,7 @@ jobs:
 
       - name: "Tofu :: Requisites :: Download k0s"
         if: inputs.k0s-version == ''
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-${{ inputs.arch }}
           path: ${{ github.workspace }}/.cache
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 873a0026a206..47cf9601b33a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -532,17 +532,17 @@ jobs:
           registry: quay.io
 
       - name: Fetch k0s amd64
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-amd64
           path: ./k0s-amd64
       - name: Fetch k0s arm64
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-arm64
           path: ./k0s-arm64
       - name: Fetch k0s arm
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-arm
           path: ./k0s-arm
@@ -601,7 +601,7 @@ jobs:
 
     steps:
       - name: Download conformance test results
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: ostests-e2e
           pattern: ostests-e2e-*-sonobuoy-results
diff --git a/.github/workflows/smoketest.yaml b/.github/workflows/smoketest.yaml
index 912e08ea5e76..6b91f4d1d209 100644
--- a/.github/workflows/smoketest.yaml
+++ b/.github/workflows/smoketest.yaml
@@ -51,7 +51,7 @@ jobs:
           cache: false
 
       - name: Download compiled executable
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: k0s-linux-${{ inputs.arch }}
 
@@ -62,13 +62,13 @@ jobs:
 
       - name: Download airgap image bundle
         if: contains(inputs.name, 'airgap') || contains(inputs.name, 'ipv6')
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: airgap-image-bundle-linux-${{ inputs.arch }}
 
       - name: Download ipv6 image bundle
         if: inputs.name == 'calico-ipv6' || inputs.name == 'kuberouter-ipv6' || (startsWith(inputs.name, 'network-conformance-') && contains(inputs.name, '-ipv6'))
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ipv6-test-image-bundle-linux-${{ inputs.arch }}
 
diff --git a/.github/workflows/win-wsl.yaml b/.github/workflows/win-wsl.yaml
index e36f2fc022c8..5889b86ac644 100644
--- a/.github/workflows/win-wsl.yaml
+++ b/.github/workflows/win-wsl.yaml
@@ -130,7 +130,7 @@ jobs:
           "WSL_IP=$wslIP" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
       - name: Download compiled binaries
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: k0s-{linux,windows}-amd64
           merge-multiple: true