diff --git a/.github/workflows/bundle-desktop-windows.yml b/.github/workflows/bundle-desktop-windows.yml
index 4acc1762e96c..f1777a8b9dad 100644
--- a/.github/workflows/bundle-desktop-windows.yml
+++ b/.github/workflows/bundle-desktop-windows.yml
@@ -167,7 +167,7 @@ jobs:
 
     steps:
       - name: Download unsigned distribution
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: windows-unsigned
           path: dist-windows
@@ -223,7 +223,7 @@ jobs:
 
     steps:
       - name: Download unsigned distribution
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: windows-unsigned
           path: dist-windows
diff --git a/.github/workflows/bundle-goose2.yml b/.github/workflows/bundle-goose2.yml
index 814ffbfa80ad..860dd781f649 100644
--- a/.github/workflows/bundle-goose2.yml
+++ b/.github/workflows/bundle-goose2.yml
@@ -110,7 +110,7 @@ jobs:
       # ── Goose CLI: download from prior run OR build from source ──
       - name: Download goose CLI from build-cli run
         if: inputs.cli-run-id != ''
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: goose-aarch64-apple-darwin
           run-id: ${{ inputs.cli-run-id }}
@@ -275,7 +275,7 @@ jobs:
       # ── Goose CLI: download from prior run OR build from source ──
       - name: Download goose CLI from build-cli run
         if: inputs.cli-run-id != ''
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: goose-x86_64-apple-darwin
           run-id: ${{ inputs.cli-run-id }}
@@ -462,7 +462,7 @@ jobs:
       # ── Goose CLI: download from prior run OR build from source ──
       - name: Download goose CLI from build-cli run
         if: inputs.cli-run-id != ''
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: goose-x86_64-unknown-linux-gnu
           run-id: ${{ inputs.cli-run-id }}
@@ -602,7 +602,7 @@ jobs:
       # ── Goose CLI: download from prior run OR build from source ──
       - name: Download goose CLI from build-cli run
         if: inputs.cli-run-id != ''
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: goose-x86_64-pc-windows-msvc
           run-id: ${{ inputs.cli-run-id }}
@@ -715,13 +715,13 @@ jobs:
       actions: read
     steps:
       - name: Download NSIS installer
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-windows-x64-nsis
           path: unsigned/nsis
 
       - name: Download MSI installer
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-windows-x64-msi
           path: unsigned/msi
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 65c1741528ce..acb0d4512d1a 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -125,7 +125,7 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           merge-multiple: true
 
diff --git a/.github/workflows/pr-comment-build-cli.yml b/.github/workflows/pr-comment-build-cli.yml
index 510fe0f72316..abff0544ecb7 100644
--- a/.github/workflows/pr-comment-build-cli.yml
+++ b/.github/workflows/pr-comment-build-cli.yml
@@ -122,7 +122,7 @@ jobs:
 
     steps:
       - name: Download CLI artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: goose-*
           path: cli-dist
diff --git a/.github/workflows/pr-comment-bundle-intel.yml b/.github/workflows/pr-comment-bundle-intel.yml
index db2263f6cc6e..3fac34d9591d 100644
--- a/.github/workflows/pr-comment-bundle-intel.yml
+++ b/.github/workflows/pr-comment-bundle-intel.yml
@@ -79,7 +79,7 @@ jobs:
 
     steps:
       - name: Download Intel artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: Goose-darwin-x64
           path: intel-dist
diff --git a/.github/workflows/pr-comment-bundle-windows.yml b/.github/workflows/pr-comment-bundle-windows.yml
index 01825d7f32e8..151ce8d0ec15 100644
--- a/.github/workflows/pr-comment-bundle-windows.yml
+++ b/.github/workflows/pr-comment-bundle-windows.yml
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: Download Windows artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: Goose-win32-x64
           path: windows-dist
diff --git a/.github/workflows/pr-comment-bundle.yml b/.github/workflows/pr-comment-bundle.yml
index 5d315fbc87b6..683ae0a6dbb5 100644
--- a/.github/workflows/pr-comment-bundle.yml
+++ b/.github/workflows/pr-comment-bundle.yml
@@ -172,7 +172,7 @@ jobs:
 
     steps:
       - name: Download ARM64 artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: Goose-darwin-arm64
           path: arm64-dist
diff --git a/.github/workflows/pr-smoke-test.yml b/.github/workflows/pr-smoke-test.yml
index f49d983dae5e..500a79d9cc8b 100644
--- a/.github/workflows/pr-smoke-test.yml
+++ b/.github/workflows/pr-smoke-test.yml
@@ -94,7 +94,7 @@ jobs:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
       - name: Download Binary
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: goose-binary
           path: target/debug
@@ -182,7 +182,7 @@ jobs:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
       - name: Download Binary
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: goose-binary
           path: target/debug
@@ -225,7 +225,7 @@ jobs:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
       - name: Download Binary
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: goose-binary
           path: target/debug
@@ -265,7 +265,7 @@ jobs:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
       - name: Download Binary
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: goosed-binary
           path: target/debug
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 4a1d9fb3cc98..333776f8069d 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -139,7 +139,7 @@ jobs:
     environment: npm-production-publishing
     steps:
       - name: Download built packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: npm-packages
           path: ui/
diff --git a/.github/workflows/release-goose2.yml b/.github/workflows/release-goose2.yml
index bc1d8e4ae766..f0fc1efa7edf 100644
--- a/.github/workflows/release-goose2.yml
+++ b/.github/workflows/release-goose2.yml
@@ -93,7 +93,7 @@ jobs:
     steps:
       - name: Download CLI artifacts
         if: needs.build-cli.result == 'success'
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: goose-*
           merge-multiple: true
@@ -101,52 +101,52 @@ jobs:
 
       - name: Download install script
         if: needs.install-script.result == 'success'
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: download_cli.sh
           path: release
 
       - name: Download macOS ARM64
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-darwin-arm64
           path: release
 
       - name: Download macOS Intel
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-darwin-x64
           path: release
 
       - name: Download Linux .deb
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-linux-x64-deb
           path: release
         continue-on-error: true
 
       - name: Download Linux AppImage
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-linux-x64-appimage
           path: release
         continue-on-error: true
 
       - name: Download Linux RPM
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-linux-x64-rpm
           path: release
         continue-on-error: true
 
       - name: Download signed Windows NSIS installer
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-windows-x64-nsis-signed
           path: release
 
       - name: Download signed Windows MSI installer
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Goose2-windows-x64-msi-signed
           path: release
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 60cea64628a0..dfb5c6b9168e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,7 +98,7 @@ jobs:
       attestations: write  # Required for SLSA build provenance attestations
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           merge-multiple: true