diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e56b53d..2972796 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -100,7 +100,7 @@ jobs:
         with:
           ref: ${{ needs.package.outputs.revision }}
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: source-release-${{ github.sha }}
           path: build/release/
@@ -138,7 +138,7 @@ jobs:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.18.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: source-release-${{ github.sha }}
           path: build/release/
diff --git a/tools/check-crate-release-policy.py b/tools/check-crate-release-policy.py
index 10ed794..1d63db9 100755
--- a/tools/check-crate-release-policy.py
+++ b/tools/check-crate-release-policy.py
@@ -17,7 +17,7 @@
 PUBLISH_WORKFLOW = WORKFLOWS / "publish-crate.yml"
 BOOTSTRAP_CHECK = ROOT / "tools" / "check-crate-publication.py"
 SOURCE_WORKFLOW = WORKFLOWS / "release.yml"
-EXPECTED_SOURCE_WORKFLOW_SHA256 = "4ab75eea4c9d25005384f222f9f24865ffa1ddee48d40a32b8e99efcad6822b9"
+EXPECTED_SOURCE_WORKFLOW_SHA256 = "13b592fd367f87ebc8c4926a514f110faadf4804206b8a2fd1e19c57b07d17c9"
 EXPECTED_PUBLICATION_WORKFLOW_SHA256 = "b21e9b715650b5f0b3f5b77eb563a4b78a0e5dbe9f07c09953fc64c6fe3f3c41"
 EXPECTED_WORKFLOWS = {
     "dependency-review.yml", "pr-title.yml", "release.yml", "validate.yml",