diff --git a/.github/workflows/_attestation-check.yaml b/.github/workflows/_attestation-check.yaml
index 70c7399..59edea7 100644
--- a/.github/workflows/_attestation-check.yaml
+++ b/.github/workflows/_attestation-check.yaml
@@ -98,7 +98,7 @@ jobs:
       actions: read
     steps:
       - name: Download the exact diagnostic evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.attest.outputs.artifact-id }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/_fleet-acceptance.yaml b/.github/workflows/_fleet-acceptance.yaml
index 3b22c1d..cbe6268 100644
--- a/.github/workflows/_fleet-acceptance.yaml
+++ b/.github/workflows/_fleet-acceptance.yaml
@@ -85,7 +85,7 @@ jobs:
           umask 077
           mkdir "$RUNNER_TEMP/fleet"
           "$PYTHON" -B scripts/coordinate-release-fleet.py select --root "$RUNNER_TEMP/fleet"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -94,7 +94,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/admission
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.plan-id }}
           repository: ${{ github.repository }}
@@ -103,7 +103,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/plan
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.inventory-id }}
           repository: ${{ github.repository }}
@@ -112,7 +112,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/inventory
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.engine-id }}
           repository: ${{ github.repository }}
@@ -121,7 +121,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/engine
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.workspaces-id }}
           repository: ${{ github.repository }}
@@ -173,7 +173,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-fleet-tools
         id: tools
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -268,7 +268,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-fleet-tools
         id: tools
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -277,7 +277,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/admission
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.ownership-id }}
           repository: ${{ github.repository }}
@@ -413,7 +413,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-fleet-tools
         id: tools
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -422,7 +422,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/admission
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.plan-id }}
           repository: ${{ github.repository }}
@@ -431,7 +431,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/plan
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.engine-id }}
           repository: ${{ github.repository }}
@@ -440,7 +440,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/engine
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.workspaces-id }}
           repository: ${{ github.repository }}
@@ -449,7 +449,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/workspaces
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.ownership-id }}
           repository: ${{ github.repository }}
@@ -604,7 +604,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-fleet-tools
         id: tools
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -622,7 +622,7 @@ jobs:
         run: |
           set -euo pipefail
           "$PYTHON" -B scripts/coordinate-release-fleet.py ownership --root "$RUNNER_TEMP/fleet"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.ownership.outputs.ownership-id }}
           repository: ${{ github.repository }}
@@ -693,7 +693,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-fleet-tools
         id: tools
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: fleet-deployment-${{ github.run_id }}-${{ github.run_attempt }}
           repository: ${{ github.repository }}
@@ -701,7 +701,7 @@ jobs:
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/fleet-results/deployment
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: fleet-cleanup-${{ github.run_id }}-${{ github.run_attempt }}
           repository: ${{ github.repository }}
@@ -709,7 +709,7 @@ jobs:
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/fleet-results/cleanup
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: fleet-readiness-${{ github.run_id }}-${{ github.run_attempt }}-*
           repository: ${{ github.repository }}
diff --git a/.github/workflows/_fleet-reconcile.yaml b/.github/workflows/_fleet-reconcile.yaml
index e03e9f6..856037c 100644
--- a/.github/workflows/_fleet-reconcile.yaml
+++ b/.github/workflows/_fleet-reconcile.yaml
@@ -78,7 +78,7 @@ jobs:
           umask 077
           mkdir "$RUNNER_TEMP/fleet"
           "$PYTHON" -B scripts/coordinate-release-fleet.py select --root "$RUNNER_TEMP/fleet"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -100,7 +100,7 @@ jobs:
             scope=(--kind site --slot "$SLOT")
           fi
           "$PYTHON" -B scripts/coordinate-release-fleet.py ownership --root "$RUNNER_TEMP/fleet" "${scope[@]}"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: steps.ownership.outputs.ownership-id != ''
         with:
           artifact-ids: ${{ steps.ownership.outputs.ownership-id }}
diff --git a/.github/workflows/_release-candidate.yaml b/.github/workflows/_release-candidate.yaml
index 66d9e7e..8a28f69 100644
--- a/.github/workflows/_release-candidate.yaml
+++ b/.github/workflows/_release-candidate.yaml
@@ -395,7 +395,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download the prepared release plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -411,7 +411,7 @@ jobs:
           python-version: "3.11"
 
       - name: Download attested workspace subjects
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ needs.prepare.outputs.single-workspace-artifact }}
           pattern: workspace-attested-${{ github.run_id }}-${{ github.run_attempt }}-*
@@ -569,7 +569,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download the prepared release plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -581,7 +581,7 @@ jobs:
 
       - name: Download the completed engine build
         if: needs.prepare.outputs.bundle == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.distribution.outputs.staging-artifact-id }}
           repository: ${{ github.repository }}
@@ -708,7 +708,7 @@ jobs:
               raise SystemExit("::error::Release artifacts require the admitted Linux self-hosted runner.")
 
       - name: Download the exact engine reference
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.engine-input.outputs.reference-artifact-id }}
           repository: ${{ github.repository }}
@@ -825,7 +825,7 @@ jobs:
           python-version: ${{ matrix.python }}
 
       - name: Download selected engine inputs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.engine-input.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -836,7 +836,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download frozen workspace assets
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.workspace-assets.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -847,7 +847,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download the candidate project declaration
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -953,7 +953,7 @@ jobs:
       EXPECTED_PLAN_SHA: ${{ needs.prepare.outputs.plan-sha }}
     steps:
       - name: Download engine qualification identity
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.engine-input.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -964,7 +964,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download the prepared release plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -975,7 +975,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download every qualification cell
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ needs.engine-input.outputs.single-qualification-artifact }}
           pattern: workspace-qualification-${{ github.run_id }}-${{ github.run_attempt }}-*
@@ -1167,7 +1167,7 @@ jobs:
           ' >> "$GITHUB_OUTPUT"
 
       - name: Download the pinned declaration
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -1179,7 +1179,7 @@ jobs:
 
       - name: Download the qualified release assets
         if: needs.prepare.outputs.bundle == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.distribution.outputs.staging-artifact-id }}
           repository: ${{ github.repository }}
@@ -1538,7 +1538,7 @@ jobs:
 
       - name: Download the qualified workspace publication inputs
         if: needs.prepare.outputs.workspaces == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.workspace-assets.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -1550,7 +1550,7 @@ jobs:
 
       - name: Download the qualified engine selection
         if: needs.prepare.outputs.workspaces == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.engine-input.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -1562,7 +1562,7 @@ jobs:
 
       - name: Download the signed engine reference
         if: needs.prepare.outputs.workspaces == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.engine-reference.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -1750,7 +1750,7 @@ jobs:
           fi
 
       - name: Download the selected plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.prepare.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -1761,7 +1761,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download the selected inventory
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.review.outputs.assets-artifact-id }}
           repository: ${{ github.repository }}
@@ -1772,7 +1772,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download the selected payload
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.review.outputs.payload-artifact-id }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/_siteops-distribution.yaml b/.github/workflows/_siteops-distribution.yaml
index d65ebac..d2df659 100644
--- a/.github/workflows/_siteops-distribution.yaml
+++ b/.github/workflows/_siteops-distribution.yaml
@@ -360,7 +360,7 @@ jobs:
           echo "staging-artifact-name=siteops-install-staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
 
       - name: Download the build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.build.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -549,7 +549,7 @@ jobs:
           python-version: ${{ matrix.python }}
 
       - name: Download the attested assets
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.attest.outputs.staging-artifact-id }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/_workspace-distribution.yaml b/.github/workflows/_workspace-distribution.yaml
index ed8cc81..9519935 100644
--- a/.github/workflows/_workspace-distribution.yaml
+++ b/.github/workflows/_workspace-distribution.yaml
@@ -102,7 +102,7 @@ jobs:
           fetch-depth: 1
 
       - name: Download the prepared release plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ inputs.plan-artifact-id }}
           repository: ${{ github.repository }}
@@ -278,7 +278,7 @@ jobs:
               raise SystemExit("::error::Release artifacts require the admitted Linux self-hosted runner.")
 
       - name: Download the prepared release plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ inputs.plan-artifact-id }}
           repository: ${{ github.repository }}
@@ -289,7 +289,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download this workspace build
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.build.outputs.artifact-id }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
index 3b57044..212abec 100644
--- a/.github/workflows/e2e-test.yaml
+++ b/.github/workflows/e2e-test.yaml
@@ -754,7 +754,7 @@ jobs:
           "$PYTHON" -B scripts/coordinate-release-fleet.py select --root "$RUNNER_TEMP/fleet"
           echo "FLEET_PYTHON=$PYTHON" >> "$GITHUB_ENV"
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: env.CANDIDATE_MODE == 'true'
         with:
           artifact-ids: ${{ steps.select.outputs.admission-id }}
@@ -764,7 +764,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/admission
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: env.CANDIDATE_MODE == 'true'
         with:
           artifact-ids: ${{ steps.select.outputs.plan-id }}
@@ -774,7 +774,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/plan
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: env.CANDIDATE_MODE == 'true'
         with:
           artifact-ids: ${{ steps.select.outputs.inventory-id }}
@@ -784,7 +784,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/inventory
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: env.CANDIDATE_MODE == 'true'
         with:
           artifact-ids: ${{ steps.select.outputs.engine-id }}
@@ -794,7 +794,7 @@ jobs:
           path: ${{ runner.temp }}/fleet/engine
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: env.CANDIDATE_MODE == 'true'
         with:
           artifact-ids: ${{ steps.select.outputs.workspaces-id }}
@@ -2706,7 +2706,7 @@ jobs:
           mkdir "$RUNNER_TEMP/acceptance"
           "$PYTHON" -B scripts/coordinate-release-fleet.py select --root "$RUNNER_TEMP/acceptance" \
             --jobs-output "$RUNNER_TEMP/acceptance/producer-jobs.json"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.admission-id }}
           repository: ${{ github.repository }}
@@ -2715,7 +2715,7 @@ jobs:
           path: ${{ runner.temp }}/acceptance/admission
           merge-multiple: true
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.select.outputs.plan-id }}
           repository: ${{ github.repository }}
@@ -2735,7 +2735,7 @@ jobs:
           set -euo pipefail
           "$PYTHON" -B scripts/coordinate-release-fleet.py evidence --root "$RUNNER_TEMP/acceptance"
       # One artifact per download keeps each receipt in its own named directory.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         id: download-disabled
         if: always() && steps.evidence.outputs.disabled-id != ''
         with:
@@ -2745,7 +2745,7 @@ jobs:
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/acceptance/evidence/disabled
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         id: download-enabled
         if: always() && steps.evidence.outputs.enabled-id != ''
         with:
@@ -2755,7 +2755,7 @@ jobs:
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/acceptance/evidence/enabled
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         id: download-existing
         if: always() && steps.evidence.outputs.existing-id != ''
         with:
@@ -2765,7 +2765,7 @@ jobs:
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/acceptance/evidence/existing
           digest-mismatch: error
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         id: download-fleet
         if: always() && steps.evidence.outputs.fleet-id != ''
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c4225f3..134a8e1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -180,7 +180,7 @@ jobs:
               raise SystemExit("::error::Release artifacts require the admitted Linux self-hosted runner.")
 
       - name: Download the pinned declaration
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.candidate.outputs.plan-artifact-id }}
           repository: ${{ github.repository }}
@@ -306,7 +306,7 @@ jobs:
           ' >> "$GITHUB_OUTPUT"
 
       - name: Download the acceptance receipt
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.acceptance.outputs.artifact-id }}
           repository: ${{ github.repository }}
@@ -413,7 +413,7 @@ jobs:
           '
 
       - name: Download the reviewed release notes
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.candidate.outputs.notes-artifact-id }}
           repository: ${{ github.repository }}
@@ -424,7 +424,7 @@ jobs:
           digest-mismatch: error
 
       - name: Download the frozen asset list
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.candidate.outputs.assets-artifact-id }}
           repository: ${{ github.repository }}
@@ -436,7 +436,7 @@ jobs:
 
       - name: Download the qualified release assets
         if: needs.candidate.outputs.bundle == 'true' || needs.candidate.outputs.workspaces == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.candidate.outputs.payload-artifact-id }}
           repository: ${{ github.repository }}