diff --git a/.github/workflows/doofus-external-trial.yml b/.github/workflows/doofus-external-trial.yml
index 6628b1e..8367545 100644
--- a/.github/workflows/doofus-external-trial.yml
+++ b/.github/workflows/doofus-external-trial.yml
@@ -406,7 +406,7 @@ jobs:
           ref: ${{ github.workflow_sha }}
 
       - name: Download durable receipt subjects
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.external-trial.outputs.receipt_artifact_name }}
           path: ${{ runner.temp }}/doofus-trial-public
@@ -492,7 +492,7 @@ jobs:
           ref: ${{ github.workflow_sha }}
 
       - name: Download attested public receipt subjects
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.external-trial.outputs.receipt_artifact_name }}
           path: ${{ runner.temp }}/doofus-trial-public
diff --git a/tests/test_doofus_external_trial_workflow.py b/tests/test_doofus_external_trial_workflow.py
index c52fc7e..055c95c 100644
--- a/tests/test_doofus_external_trial_workflow.py
+++ b/tests/test_doofus_external_trial_workflow.py
@@ -59,7 +59,7 @@ def test_workflow_actions_are_commit_pinned_and_permissions_are_minimal() -> Non
         in uses
     )
     assert (
-        "actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0"
+        "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
         in uses
     )
     assert "actions: read" in text