diff --git a/.github/workflows/custom-test.yml b/.github/workflows/custom-test.yml
index 76b52eb8..50252ced 100644
--- a/.github/workflows/custom-test.yml
+++ b/.github/workflows/custom-test.yml
@@ -125,7 +125,7 @@ jobs:
         run: curl -o root.json ${METADATA_URL}/5.root.json
 
       - name: Download bundle to verify
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
         with:
           name: bundle
 
@@ -154,7 +154,7 @@ jobs:
         run: curl -o root.json ${METADATA_URL}/1.root.json
 
       - name: Download bundle to verify
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
         with:
           name: bundle
 
@@ -197,7 +197,7 @@ jobs:
           tar -xvf sigstore-cli/build/distributions/sigstore-cli-*.tar --strip-components 1
 
       - name: Download bundle to verify
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
         with:
           name: bundle
 
diff --git a/.github/workflows/deploy-to-gcs.yml b/.github/workflows/deploy-to-gcs.yml
index 4d9b3296..b0f8c2e8 100644
--- a/.github/workflows/deploy-to-gcs.yml
+++ b/.github/workflows/deploy-to-gcs.yml
@@ -12,7 +12,7 @@ jobs:
       id-token: 'write' # For authenticating with the GitHub workflow identity
 
     steps:
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
         with:
           name: github-pages