diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7a00ff8..c816cc0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -121,7 +121,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: verified-npm-package
           path: ${{ runner.temp }}/release-artifact
@@ -202,7 +202,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: verified-npm-package
           path: ${{ runner.temp }}/release-artifact
diff --git a/tests/release-readiness.test.ts b/tests/release-readiness.test.ts
index 1f33c13..3632bfa 100644
--- a/tests/release-readiness.test.ts
+++ b/tests/release-readiness.test.ts
@@ -39,8 +39,11 @@ describe("release readiness", () => {
     const actions = workflow.match(/uses:\s+actions\/[^@\s]+@([^\s#]+)/g) ?? [];
 
     expect(workflow).toContain("Verify release tag matches package version and protected main");
-    expect(workflow).toContain("actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a");
-    expect(workflow).toContain("actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c");
+    // Pin by full commit SHA, but do not hard-code which SHA: Dependabot
+    // bumps the pin and a literal here turned every such PR red.
+    expect(workflow).toMatch(/actions\/upload-artifact@[0-9a-f]{40}\s/);
+    expect(workflow).toMatch(/actions\/download-artifact@[0-9a-f]{40}\s/);
+    expect(workflow).not.toMatch(/actions\/(?:upload|download)-artifact@v\d/);
     expect(workflow).toContain('cp scripts/resolve-npm-publication.mjs "$ARTIFACT_DIR/"');
     expect(publishJob).toContain("id-token: write");
     expect(publishJob).toContain("sha256sum -c artifact.sha256");