diff --git a/.github/workflows/attach_release_assets.yml b/.github/workflows/attach_release_assets.yml
index 1977239d..bf94ceb8 100644
--- a/.github/workflows/attach_release_assets.yml
+++ b/.github/workflows/attach_release_assets.yml
@@ -26,7 +26,7 @@ jobs:
           uses: actions/checkout@v4
 
         - name: Download artifact
-          uses: actions/download-artifact@v4
+          uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
           with:
            pattern: firmware-*
            merge-multiple: true
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 69ee561b..3494f690 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -161,7 +161,7 @@ jobs:
           sed -i '1d' pmr-nrf91-default-${{ env.VERSION }}.txt
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-oob
         with:
           name: firmware-oob
@@ -199,7 +199,7 @@ jobs:
           cp dfu_application.zip hello.nrfcloud.com-${{ env.VERSION }}-thingy91x-nrf91-trace-dfu.zip
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-oob-trace
         with:
           name: firmware-oob-trace
@@ -250,7 +250,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ inputs.build_debug }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-oob-debug
         with:
           name: firmware-oob-debug
@@ -300,7 +300,7 @@ jobs:
           cp nrf53-bl-*.hex $(pwd)/nrf/applications/connectivity_bridge/build/
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-connectivity-bridge
         with:
           name: firmware-connectivity-bridge
@@ -329,7 +329,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ inputs.build_bl_update }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-bl-update
         with:
           name: firmware-bl-update
diff --git a/.github/workflows/dfu_check.yml b/.github/workflows/dfu_check.yml
index dbfce9f4..9a66ae6e 100644
--- a/.github/workflows/dfu_check.yml
+++ b/.github/workflows/dfu_check.yml
@@ -52,7 +52,7 @@ jobs:
           west update -o=--depth=1 -n
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: firmware-*
           merge-multiple: true
diff --git a/.github/workflows/doc-build.yml b/.github/workflows/doc-build.yml
index d3c174ba..58fc4277 100644
--- a/.github/workflows/doc-build.yml
+++ b/.github/workflows/doc-build.yml
@@ -82,7 +82,7 @@ jobs:
 
       - name: Store
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'external') || contains(github.event.pull_request.labels.*.name, 'CI-trusted-author') }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docs
           retention-days: 5
diff --git a/.github/workflows/on_target.yml b/.github/workflows/on_target.yml
index 58219e77..e3a9de50 100644
--- a/.github/workflows/on_target.yml
+++ b/.github/workflows/on_target.yml
@@ -58,7 +58,7 @@ jobs:
           path: thingy91x-oob
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: firmware-*
           merge-multiple: true
@@ -140,7 +140,7 @@ jobs:
 
       - name: Create Report Artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-report
         with:
           name: test-report
@@ -149,7 +149,7 @@ jobs:
 
       - name: Push log files to artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: artifact-upload-test-logs
         with:
           name: test-logs