diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index eb95aae..a149718 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -109,7 +109,7 @@ jobs:
 
     steps:
       - name: Download distribution artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
@@ -133,7 +133,7 @@ jobs:
 
     steps:
       - name: Download distribution artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
diff --git a/AUDIT.md b/AUDIT.md
index 98cbf87..a9d4440 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,5 +1,9 @@
 # Cycles Protocol v0.1.25 — Client (Python) Audit
 
+## 2026-10-11 — Dependency maintenance
+
+PR #104 updates the SHA-pinned download-artifact action from 8.0.1 to 8.0.2, which includes artifact-service rate-limit retry handling. The branch is brought up to date with main. Python dependencies, SDK source, and YAML protocol fixtures are unchanged. Existing Python 3.10/3.12 lint, typing, build, coverage, and durable recovery conformance checks remain enabled and must pass before merge.
+
 ## 2026-09-24 — Dependency maintenance
 
 Dependabot PR #100 updates the SHA-pinned CodeQL SARIF uploader from