diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index dd769b32e4a..d5882a74620 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -138,7 +138,7 @@ jobs:
         ref: ${{ needs.env-protect-setup.outputs.ref }}
     - name: Add pwd to git safe dir
       run: git config --global --add safe.directory `pwd`
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: get bazel config
       uses: ./.github/actions/bazelrc
       with:
diff --git a/.github/workflows/cli_release.yaml b/.github/workflows/cli_release.yaml
index 03c23182ad5..e6a4022c90a 100644
--- a/.github/workflows/cli_release.yaml
+++ b/.github/workflows/cli_release.yaml
@@ -120,10 +120,10 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       with:
         name: macos-artifacts
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       with:
         name: artifact-upload-log
     - name: Import GPG key
@@ -168,7 +168,7 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Create Release
       env:
         REF: ${{ github.event.ref }}
@@ -221,7 +221,7 @@ jobs:
         git config --global user.email 'build@pixielabs.ai'
         git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
         git config --global commit.gpgsign true
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       id: download-artifact
       with:
         name: manifest-updates
diff --git a/.github/workflows/cloud_release.yaml b/.github/workflows/cloud_release.yaml
index 644f1eacceb..dd53feebfae 100644
--- a/.github/workflows/cloud_release.yaml
+++ b/.github/workflows/cloud_release.yaml
@@ -71,7 +71,7 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Create Release
       env:
         REF: ${{ github.event.ref }}
diff --git a/.github/workflows/operator_release.yaml b/.github/workflows/operator_release.yaml
index 957009ed770..1938c7c205e 100644
--- a/.github/workflows/operator_release.yaml
+++ b/.github/workflows/operator_release.yaml
@@ -89,7 +89,7 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Create Release
       env:
         REF: ${{ github.event.ref }}
@@ -121,7 +121,7 @@ jobs:
       with:
         fetch-depth: 0
         ref: gh-pages
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Setup git
       shell: bash
       env:
@@ -175,7 +175,7 @@ jobs:
         git config --global user.email 'build@pixielabs.ai'
         git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
         git config --global commit.gpgsign true
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       id: download-artifact
       with:
         name: manifest-updates
diff --git a/.github/workflows/perf_common.yaml b/.github/workflows/perf_common.yaml
index 742dd02625e..3b2fc55e8b2 100644
--- a/.github/workflows/perf_common.yaml
+++ b/.github/workflows/perf_common.yaml
@@ -119,7 +119,7 @@ jobs:
     outputs:
       experiments: ${{ steps.get-outputs.outputs.run_output }}
     steps:
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - id: get-outputs
       run: |
         all_run_output="$(cat */run_output | jq --slurp -c '.[]')"
diff --git a/.github/workflows/release_update_docs_px_dev.yaml b/.github/workflows/release_update_docs_px_dev.yaml
index 5750e9aa596..22de9e2cb57 100644
--- a/.github/workflows/release_update_docs_px_dev.yaml
+++ b/.github/workflows/release_update_docs_px_dev.yaml
@@ -68,7 +68,7 @@ jobs:
         git config --global user.name 'pixie-io-buildbot'
         git config --global user.email 'build@pixielabs.ai'
         git remote add fork git@github.com:pixie-io-buildbot/docs.px.dev.git
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       with:
         name: pxl_documentation
         path: external/
diff --git a/.github/workflows/update_script_bundle.yaml b/.github/workflows/update_script_bundle.yaml
index 027eaaf375a..70f57cc145f 100644
--- a/.github/workflows/update_script_bundle.yaml
+++ b/.github/workflows/update_script_bundle.yaml
@@ -50,7 +50,7 @@ jobs:
       with:
         fetch-depth: 0
         ref: gh-pages
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Import GPG key
       env:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
diff --git a/.github/workflows/vizier_release.yaml b/.github/workflows/vizier_release.yaml
index 7fbeaa34a6c..fbc9d86ef17 100644
--- a/.github/workflows/vizier_release.yaml
+++ b/.github/workflows/vizier_release.yaml
@@ -96,7 +96,7 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Create Release
       env:
         REF: ${{ github.event.ref }}
@@ -128,7 +128,7 @@ jobs:
       with:
         fetch-depth: 0
         ref: gh-pages
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
     - name: Setup git
       shell: bash
       env:
@@ -182,7 +182,7 @@ jobs:
         git config --global user.email 'build@pixielabs.ai'
         git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
         git config --global commit.gpgsign true
-    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
+    - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
       id: download-artifact
       with:
         name: manifest-updates