diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c14c46..ad7e951 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -207,7 +207,7 @@ jobs:
     steps:
       # download-artifact validates the workflow artifact digest recorded by upload-artifact.
       - name: Download verified release artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-package
           path: ./artifacts
@@ -287,7 +287,7 @@ jobs:
       package_sha256: ${{ steps.stage.outputs.package_sha256 }}
     steps:
       - name: Download attested release candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: attested-release-candidate
           path: ./candidate
@@ -831,7 +831,7 @@ jobs:
           fi
 
       - name: Download canonical release assets
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: canonical-release-assets
           path: ./artifacts
@@ -1022,7 +1022,7 @@ jobs:
       contents: write       # required only for completing the staged GitHub Release
     steps:
       - name: Download canonical release assets
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: canonical-release-assets
           path: ./artifacts