diff --git a/.github/workflows/container-release.yml b/.github/workflows/container-release.yml
index 6f141cd874..83654c0f73 100644
--- a/.github/workflows/container-release.yml
+++ b/.github/workflows/container-release.yml
@@ -241,7 +241,7 @@ jobs:
       - *set-up-docker-buildx
 
       - name: Download verified platform digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: ${{ runner.temp }}/codex-security-platform-digests
           pattern: codex-security-image-digest-*
diff --git a/.github/workflows/native-artifacts.yml b/.github/workflows/native-artifacts.yml
index a59b2aeafe..7df9a780a4 100644
--- a/.github/workflows/native-artifacts.yml
+++ b/.github/workflows/native-artifacts.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download verified platform payloads
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: native-platform-*-${{ github.sha }}
           merge-multiple: true
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index c96b833aaa..2c5f5d83b6 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -218,7 +218,7 @@ jobs:
       - *install-dependencies
       - &download-package-for-this-commit
         name: Download package for this commit
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: package-${{ github.sha }}
           path: dist
diff --git a/.github/workflows/node-github-release.yml b/.github/workflows/node-github-release.yml
index fe4d8edd36..71d50148a2 100644
--- a/.github/workflows/node-github-release.yml
+++ b/.github/workflows/node-github-release.yml
@@ -609,7 +609,7 @@ jobs:
       - *action-reuse-distribution
 
       - name: Download verified CLI runtime lock
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.action-verify.outputs.runtime-lock-artifact }}
           path: ${{ runner.temp }}/action-runtime-lock
diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index 015b56ec77..1e7d30b19c 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -313,7 +313,7 @@ jobs:
           ' "$(npm --version)"
 
       - name: Download verified package
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.verify.outputs.artifact-id }}
           path: dist
diff --git a/.github/workflows/test-quality.yml b/.github/workflows/test-quality.yml
index 3b2e12d465..8e87c89285 100644
--- a/.github/workflows/test-quality.yml
+++ b/.github/workflows/test-quality.yml
@@ -169,7 +169,7 @@ jobs:
           setup-node: false
       - name: Install dependencies
         run: pnpm --dir sdk/typescript install --frozen-lockfile
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: runner-*
           merge-multiple: true