diff --git a/.github/workflows/agent-browser-install.yml b/.github/workflows/agent-browser-install.yml
index 00f0b5f732..df2a0a74a3 100644
--- a/.github/workflows/agent-browser-install.yml
+++ b/.github/workflows/agent-browser-install.yml
@@ -78,7 +78,7 @@ jobs:
           node-version: "24"
 
       - name: Download packed install fixture
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: agent-browser-install-pack
           path: ${{ runner.temp }}/fusion-agent-browser-pack
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index d23036a912..3db1ac6e05 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -47,7 +47,7 @@ jobs:
             ${{ runner.os }}-derived-data-
 
       - name: Download dashboard artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dashboard-dist-client
           path: packages/dashboard/dist/client
@@ -128,7 +128,7 @@ jobs:
             ${{ runner.os }}-gradle-
 
       - name: Download dashboard artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dashboard-dist-client
           path: packages/dashboard/dist/client
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9cdaee348c..93c7a6e904 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -618,7 +618,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
diff --git a/.github/workflows/test-release.yml b/.github/workflows/test-release.yml
index 4e8298ae6d..04cc23b0ff 100644
--- a/.github/workflows/test-release.yml
+++ b/.github/workflows/test-release.yml
@@ -521,7 +521,7 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
diff --git a/packages/cli/src/__tests__/ci-workflow.test.ts b/packages/cli/src/__tests__/ci-workflow.test.ts
index 43b4c0ac2a..780dfc91a3 100644
--- a/packages/cli/src/__tests__/ci-workflow.test.ts
+++ b/packages/cli/src/__tests__/ci-workflow.test.ts
@@ -859,12 +859,11 @@ describe("Cross-platform agent-browser install workflow", () => {
     expect(content).toContain('dependencies["agent-browser"]');
     expect(content).toContain("agent-browser-version.txt");
     /*
-    FNXC:CI 2026-07-28-01:35:
-    Dependabot PR #2444 bumps actions/upload-artifact 4→7 on the agent-browser install workflow.
-    Gate pin must track the workflow pin; download-artifact stays at v4 until a paired bump.
+    FNXC:CI 2026-08-01-19:45:
+    The CI-shape contract tracks the artifact action pins used by the agent-browser install workflow.
     */
     expect(content).toContain("actions/upload-artifact@v7");
-    expect(content).toContain("actions/download-artifact@v4");
+    expect(content).toContain("actions/download-artifact@v8");
     expect(content).toContain("Packed Fusion manifest lost the exact agent-browser pin");
     expect(content).toContain("Packed Fusion manifest lost the agent-browser bin");
     expect(content).toContain("Packed Fusion tarball omitted agent-browser.mjs");