diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml
index 6810af9..fcbf8ab 100644
--- a/.github/workflows/setup.yml
+++ b/.github/workflows/setup.yml
@@ -80,7 +80,7 @@ jobs:
       with:
         python-version: '3.13'
     - uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
-    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         path: dist
         merge-multiple: true
@@ -95,7 +95,7 @@ jobs:
       # this permission is mandatory for trusted publishing
       id-token: write
     steps:
-    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+    - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         path: dist
         merge-multiple: true