diff --git a/.github/workflows/build_and_publish.yml b/.github/workflows/build_and_publish.yml
index 9054ef8..f7ca28a 100644
--- a/.github/workflows/build_and_publish.yml
+++ b/.github/workflows/build_and_publish.yml
@@ -58,7 +58,7 @@ jobs:
       # Trusted Publishing (OIDC). No long-lived API token is stored.
       id-token: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/