diff --git a/.github/workflows/ebpf.yml b/.github/workflows/ebpf.yml
index 1ebae8f..7f306b1 100644
--- a/.github/workflows/ebpf.yml
+++ b/.github/workflows/ebpf.yml
@@ -166,7 +166,7 @@ jobs:
           cargo xtask build-ebpf
           cargo xtask ebpf-check
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: cfc-ebpf-object
           path: crates/cfc-ebpf/target/bpfel-unknown-none/release/cfc-ebpf.o
@@ -189,7 +189,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y protobuf-compiler libnfnetlink-dev libnetfilter-queue-dev
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: cfc-ebpf-object
           path: obj
@@ -248,7 +248,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y protobuf-compiler libnfnetlink-dev libnetfilter-queue-dev util-linux
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: cfc-ebpf-object
           path: obj
@@ -350,7 +350,7 @@ jobs:
           sudo apt-get install -y protobuf-compiler libnfnetlink-dev \
             libnetfilter-queue-dev qemu-system-x86 cpio busybox-static
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: cfc-ebpf-object
           path: obj
@@ -523,7 +523,7 @@ jobs:
           fi
           exit "${CODE}"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: guest-log-${{ matrix.kernel }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1872d1..fc1a08e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -518,7 +518,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: build-linux
           path: dist
@@ -540,7 +540,7 @@ jobs:
     permissions:
       actions: read
       contents: write
-    uses: Project-Colony/Project-Colony-Resources/.github/workflows/sign-and-publish.yml@619460ff4dc0049f129955f0988d368427b9eedb # organisation pin
+    uses: Project-Colony/Project-Colony-Resources/.github/workflows/sign-and-publish.yml@1973616f4deb2182855decf446d8e2d78ad7aa29 # organisation pin
     with:
       tag: ${{ needs.release-please.outputs.tag_name || inputs.tag }}
       assets: >-
diff --git a/.github/workflows/rhel.yml b/.github/workflows/rhel.yml
index 6b33f1f..12edc52 100644
--- a/.github/workflows/rhel.yml
+++ b/.github/workflows/rhel.yml
@@ -318,7 +318,7 @@ jobs:
         # instead of a toolchain bootstrap. Fedora RPMs, so they fit a
         # Fedora VM; a Rocky 9 host still has to build by hand until
         # rust-toolset is tried.
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rpms-fedora
           path: |