diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 7d1460132..ddebbca4d 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -127,7 +127,7 @@ jobs:
         run: echo "CI_JOB_START_EPOCH_MS=$(( $(date +%s) * 1000 ))" >> "$GITHUB_ENV"
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
         with:
           node-version-file: .nvmrc
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e0d442ac..4875d30a3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -452,7 +452,7 @@ jobs:
       # exactly the layout c8 expects from a single run (test.yml's
       # coverage-gate job does the identical merge for the same reason).
       - name: Download every shard's raw coverage
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53  # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: coverage-tmp-rc-shard-*
           path: coverage/tmp
@@ -727,7 +727,7 @@ jobs:
         run: npm ci
 
       - name: Download every shard's raw coverage
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53  # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: coverage-tmp-finalize-shard-*
           path: coverage/tmp
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 92731bc1f..3ea4c174d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -747,7 +747,7 @@ jobs:
       # is exactly the layout c8 expects from a single run. The dumps are
       # per-process files with distinct names, so there is nothing to collide.
       - name: Download every shard's raw coverage
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53  # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: coverage-tmp-shard-*
           path: coverage/tmp