@@ -76,7 +76,7 @@
 
 ## Integration with Existing Release Workflows
 
-Release Please creates release PRs with updated version numbers and changelogs. When a release PR is merged, it creates a git tag for the new version. The existing release workflow (`.github/workflows/release.yml`) is configured to trigger on these tags, handling artifact building, signing, and publishing. The workflow uses cargo-dist v0.31.0 for distribution and pins all GitHub Actions to specific commit SHAs (`actions/checkout@v6.0.2`, `actions/upload-artifact@v7.0.0`, `actions/download-artifact@v8`) for improved security and reproducibility. Build artifacts include attestations generated via `actions/attest-build-provenance@v4`, which provide cryptographically verifiable build provenance for supply chain security. This ensures that the release process is fully automated from commit to published release [source](https://github.com/EvilBit-Labs/gold_digger/issues/57#issuecomment-3203749857).
+Release Please creates release PRs with updated version numbers and changelogs. When a release PR is merged, it creates a git tag for the new version. The existing release workflow (`.github/workflows/release.yml`) is configured to trigger on these tags, handling artifact building, signing, and publishing. The workflow uses cargo-dist v0.31.0 for distribution and pins all GitHub Actions to specific commit SHAs (`actions/checkout@v6.0.2`, `actions/upload-artifact@v7.0.1`, `actions/download-artifact@v8`) for improved security and reproducibility. Build artifacts include attestations generated via `actions/attest-build-provenance@v4`, which provide cryptographically verifiable build provenance for supply chain security. This ensures that the release process is fully automated from commit to published release [source](https://github.com/EvilBit-Labs/gold_digger/issues/57#issuecomment-3203749857).
 
 ```yaml
 name: Release

@@ -147,7 +147,7 @@
 
 The release workflow follows security best practices:
 
-- **Pinned Action Commits**: All GitHub Actions are pinned to specific commit SHAs rather than floating version tags, ensuring reproducibility and protecting against supply chain attacks. Examples include `actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd` (v6.0.2), `actions/upload-artifact@v7.0.0`, and `actions/download-artifact@v8`.
+- **Pinned Action Commits**: All GitHub Actions are pinned to specific commit SHAs rather than floating version tags, ensuring reproducibility and protecting against supply chain attacks. Examples include `actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd` (v6.0.2), `actions/upload-artifact@v7.0.1`, and `actions/download-artifact@v8`.
 
 - **Build Provenance**: The `actions/attest-build-provenance@v4` step creates verifiable attestations for all artifacts, providing cryptographic proof of the build environment and process.