diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index df3e628..f0ca913 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -84,7 +84,7 @@ jobs:
     - name: Upload the build artifact
       if: github.event_name == 'push'
       # Do not use v4 until merge behavior can be rebuilt
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
       with:
         # By uploading to the same artifact we can download all of the packages
         # and upload them all to anaconda.org in a single job
@@ -100,7 +100,7 @@ jobs:
       with:
         fetch-depth: 0
     - name: Download the build artifacts
-      uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4
+      uses: actions/download-artifact@v3
       with:
         name: package-${{ github.sha }}
         path: conda-bld