diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
index fc952e83..2c9745f4 100644
--- a/.github/workflows/documentation.yaml
+++ b/.github/workflows/documentation.yaml
@@ -208,7 +208,7 @@ jobs:
       # PEP-440 pyproject version, which loses the canonical tag form). Pull it
       # so the deploy script can label the frozen snapshot and pick the channel.
       - name: Download release-tag artifact from the release run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           name: release-tag
           path: release-tag-artifact
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 6b4a8d8e..d11ebe38 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -605,7 +605,7 @@ jobs:
       id-token: write  # OIDC token for Trusted Publisher
     steps:
       - name: Download all build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           pattern: wheels-*
           path: dist
@@ -646,7 +646,7 @@ jobs:
       - name: Download CycloneDX SBOM
         # AAASM-3615: pull the SBOM built by the `sbom` job so it can be
         # attached to the Release below.
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           name: sbom
       - name: Create tag and GitHub Release
diff --git a/.github/workflows/rw_run_all_test_and_record.yaml b/.github/workflows/rw_run_all_test_and_record.yaml
index a459cd4c..25a766ab 100644
--- a/.github/workflows/rw_run_all_test_and_record.yaml
+++ b/.github/workflows/rw_run_all_test_and_record.yaml
@@ -172,7 +172,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download all-test coverage XML report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           name: all-test_coverage_xml_report
           path: ./