diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index d47ddb7..f37d606 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -253,7 +253,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Download reviewed distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-dist-${{ github.run_id }}
           path: dist
@@ -329,7 +329,7 @@ jobs:
       id-token: write
     steps:
       - name: Download reviewed distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-dist-${{ github.run_id }}
           path: dist
@@ -359,13 +359,13 @@ jobs:
       attestations: write
     steps:
       - name: Download reviewed distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-dist-${{ github.run_id }}
           path: dist
 
       - name: Download release metadata
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-release-metadata-${{ github.run_id }}
           path: dist
@@ -425,13 +425,13 @@ jobs:
           python-version: "3.13"
 
       - name: Download reviewed distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-dist-${{ github.run_id }}
           path: dist
 
       - name: Download release metadata
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: base-cli-release-metadata-${{ github.run_id }}
           path: dist