diff --git a/.github/workflows/auto-prerelease.yml b/.github/workflows/auto-prerelease.yml
index 9e2d3cc..8765882 100644
--- a/.github/workflows/auto-prerelease.yml
+++ b/.github/workflows/auto-prerelease.yml
@@ -86,7 +86,7 @@ jobs:
           # npm packages + tsconfig + value of `include` in tsconfig
           key: typescript-cache-tsc-${{ hashFiles('**/*.tsbuildinfo') }}
           enableCrossOsArchive: true
-      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: dist
           path: ${{ github.workspace }}/dist
@@ -124,7 +124,7 @@ jobs:
           disable-sudo: true
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: ${{ matrix.version }}
@@ -210,7 +210,7 @@ jobs:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           ref: ${{ needs.tag.outputs.commit_sha }}
-      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: lts/*
diff --git a/.github/workflows/eslint.yml b/.github/workflows/eslint.yml
index 2b99eb4..0926837 100644
--- a/.github/workflows/eslint.yml
+++ b/.github/workflows/eslint.yml
@@ -86,7 +86,7 @@ jobs:
           sarif_file: eslint-results.sarif
         continue-on-error: true
         # https://microsoft.github.io/sarif-web-component/
-      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         if: ${{ steps.g_cql_upload.outcome == 'failure' }}
         with:
           path: eslint-results.sarif