diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bd0022c..c5b8f8d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -157,7 +157,7 @@ jobs:
           ' "$RUNNER_TEMP/pypi-environment.json"
 
       - name: Download exact candidate artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: mcp-audits-${{ inputs.tag }}
           path: release/