diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 7f7e11a..75ddd15 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -395,7 +395,7 @@ jobs:
         run: python3 .gitea/workflows/release.py prepare --output build-plan.json
       - name: Store the image plan
         id: artifact
-        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: build-plan
           path: build-plan.json
@@ -435,7 +435,7 @@ jobs:
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - name: Download the checked image plan
         id: inputs
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: build-plan
       - name: Build or reuse this image
@@ -447,7 +447,7 @@ jobs:
         run: python3 .gitea/workflows/release.py image --image "$IMAGE_NAME" --output image.json
       - name: Store the image result
         id: artifact
-        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: image-${{ matrix.name }}
           path: image.json
@@ -482,7 +482,7 @@ jobs:
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - name: Download all image results
         id: inputs
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: artifacts
       - name: Pin SHA tags and write the complete release
@@ -495,7 +495,7 @@ jobs:
           --plan artifacts/build-plan/build-plan.json
       - name: Store commit release
         id: artifact
-        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: release-${{ github.sha }}
           path: release.json