diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml
index 54e2cfc..b26ac9f 100644
--- a/.github/workflows/setup.yml
+++ b/.github/workflows/setup.yml
@@ -81,7 +81,7 @@ jobs:
       with:
         python-version: '3.13'
     - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0
-    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         path: dist
         merge-multiple: true
@@ -96,7 +96,7 @@ jobs:
       # this permission is mandatory for trusted publishing
       id-token: write
     steps:
-    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         path: dist
         merge-multiple: true