diff --git a/.github/workflows/agentops-watchdog.yml b/.github/workflows/agentops-watchdog.yml
index 2f2168ca..c46bccac 100644
--- a/.github/workflows/agentops-watchdog.yml
+++ b/.github/workflows/agentops-watchdog.yml
@@ -72,7 +72,7 @@ jobs:
       # downloads when the artifact does not exist yet, instead of
       # surfacing a red error annotation on every first run.
       - name: Restore watchdog history (if any)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: agentops-watchdog-history
           path: .agentops/agent/
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a2247308..36441840 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -531,7 +531,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Download all artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: artifacts
       - name: Render consolidated summary
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4216c79d..7e221560 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -96,7 +96,7 @@ jobs:
       id-token: write # Required for PyPI Trusted Publishing (OIDC)
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
@@ -185,7 +185,7 @@ jobs:
       id-token: write # Required for PyPI trusted publishing (OIDC)
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
@@ -304,13 +304,13 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Download Python dist artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
 
       - name: Download VSIX artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vsix
           path: vsix/
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index ed9c23cc..0d98c11b 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -59,7 +59,7 @@ jobs:
       id-token: write # Required for PyPI Trusted Publishing (OIDC)
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/