diff --git a/.github/workflows/figma-release.yml b/.github/workflows/figma-release.yml
index 963291aaa27634..d90c6c2869d682 100644
--- a/.github/workflows/figma-release.yml
+++ b/.github/workflows/figma-release.yml
@@ -96,7 +96,7 @@ jobs:
       embed_label: ${{ steps.resolve.outputs.embed_label }}
     steps:
       - name: Checkout ${{ inputs.ref }}
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 0
@@ -186,7 +186,7 @@ jobs:
       # Check out the exact commit resolved by `setup` so every platform builds
       # an identical tree even if the branch moves mid-run.
       - name: Checkout ${{ needs.setup.outputs.sha }}
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.setup.outputs.sha }}
           fetch-depth: 0
@@ -242,7 +242,7 @@ jobs:
           ls -l
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.platform }}
           path: dist/*
@@ -256,13 +256,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout ${{ needs.setup.outputs.sha }}
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.setup.outputs.sha }}
           fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
           merge-multiple: true
@@ -331,10 +331,14 @@ jobs:
           TARGET_SHA: ${{ needs.setup.outputs.sha }}
         run: |
           set -euo pipefail
+          # --repo is required: the notes step adds an `upstream` remote, and an
+          # unqualified `gh` resolves to the base repo (upstream bazelbuild/bazel)
+          # rather than this fork. Pin it to this repo explicitly.
           # Tag == embed_label so the download URL matches what Bazelisk derives
           # from USE_BAZEL_VERSION=figma/<embed_label>. Target the exact commit
           # the whole run was pinned to in the `setup` job.
           gh release create "$EMBED_LABEL" \
+            --repo "$GITHUB_REPOSITORY" \
             --target "$TARGET_SHA" \
             --title "Bazel $EMBED_LABEL" \
             --notes-file RELEASE_NOTES.md \