diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml
new file mode 100644
index 0000000..ceb58e5
--- /dev/null
+++ b/.github/actions/download-artifact/action.yml
@@ -0,0 +1,51 @@
+name: Download Artifact
+description: Thin wrapper around actions/download-artifact, SHA-pinned centrally so every repo tracks the same version via @main.
+
+inputs:
+  name:
+    description: Name of the artifact to download. Empty downloads all artifacts from the run.
+    required: false
+    default: ''
+  path:
+    description: Destination directory. Empty uses the current working directory.
+    required: false
+    default: ''
+  pattern:
+    description: Glob pattern of artifact names to download when name is empty.
+    required: false
+    default: ''
+  merge-multiple:
+    description: Merge downloaded artifacts into a single directory instead of one subdir each.
+    required: false
+    default: 'false'
+  github-token:
+    description: Token for downloading artifacts from a different repository or run. Empty stays within the current run.
+    required: false
+    default: ''
+  repository:
+    description: Repository owner/name to download from. Used only with github-token.
+    required: false
+    default: ${{ github.repository }}
+  run-id:
+    description: Workflow run ID to download from. Used only with github-token.
+    required: false
+    default: ${{ github.run_id }}
+
+outputs:
+  download-path:
+    description: Absolute path where the artifacts were downloaded.
+    value: ${{ steps.download.outputs.download-path }}
+
+runs:
+  using: composite
+  steps:
+    - id: download
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+        pattern: ${{ inputs.pattern }}
+        merge-multiple: ${{ inputs.merge-multiple }}
+        github-token: ${{ inputs.github-token }}
+        repository: ${{ inputs.repository }}
+        run-id: ${{ inputs.run-id }}
diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml
new file mode 100644
index 0000000..c922262
--- /dev/null
+++ b/.github/actions/upload-artifact/action.yml
@@ -0,0 +1,56 @@
+name: Upload Artifact
+description: Thin wrapper around actions/upload-artifact, SHA-pinned centrally so every repo tracks the same version via @main.
+
+inputs:
+  name:
+    description: Artifact name.
+    required: false
+    default: 'artifact'
+  path:
+    description: A file, directory, or wildcard pattern that describes what to upload.
+    required: true
+  if-no-files-found:
+    description: Behavior when no files match path ('warn', 'error', or 'ignore').
+    required: false
+    default: 'warn'
+  retention-days:
+    description: Days to keep the artifact. Empty uses the repository default.
+    required: false
+    default: ''
+  compression-level:
+    description: Zip compression level, 0 (none) to 9 (best).
+    required: false
+    default: '6'
+  overwrite:
+    description: Delete an existing artifact with the same name before uploading.
+    required: false
+    default: 'false'
+  include-hidden-files:
+    description: Include files that start with a dot.
+    required: false
+    default: 'false'
+
+outputs:
+  artifact-id:
+    description: GitHub ID of the uploaded artifact, usable with the REST API.
+    value: ${{ steps.upload.outputs.artifact-id }}
+  artifact-url:
+    description: URL to download the artifact from the run's UI.
+    value: ${{ steps.upload.outputs.artifact-url }}
+  artifact-digest:
+    description: SHA-256 digest of the uploaded artifact.
+    value: ${{ steps.upload.outputs.artifact-digest }}
+
+runs:
+  using: composite
+  steps:
+    - id: upload
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+        if-no-files-found: ${{ inputs.if-no-files-found }}
+        retention-days: ${{ inputs.retention-days }}
+        compression-level: ${{ inputs.compression-level }}
+        overwrite: ${{ inputs.overwrite }}
+        include-hidden-files: ${{ inputs.include-hidden-files }}
diff --git a/README.md b/README.md
index fafb57a..afe924d 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,8 @@ Building blocks for your own jobs. See [`docs/actions/`](docs/actions).
 | `checkout` | Centrally-pinned wrapper for `actions/checkout` | [docs](docs/actions/checkout.md) |
 | `aws-credentials` | Centrally-pinned wrapper for `configure-aws-credentials` (OIDC or static keys) | [docs](docs/actions/aws-credentials.md) |
 | `setup-opentofu` | Centrally-pinned wrapper for `opentofu/setup-opentofu` | [docs](docs/actions/setup-opentofu.md) |
+| `upload-artifact` | Centrally-pinned wrapper for `actions/upload-artifact` | [docs](docs/actions/upload-artifact.md) |
+| `download-artifact` | Centrally-pinned wrapper for `actions/download-artifact` | [docs](docs/actions/download-artifact.md) |
 
 ## Reusable workflows
 
diff --git a/docs/actions/download-artifact.md b/docs/actions/download-artifact.md
new file mode 100644
index 0000000..6fbcf9d
--- /dev/null
+++ b/docs/actions/download-artifact.md
@@ -0,0 +1,34 @@
+# `download-artifact`
+
+Thin wrapper around [`actions/download-artifact`](https://github.com/actions/download-artifact), SHA-pinned centrally so every repo tracks the same version via `@main`. Downloads a workflow artifact, e.g. a build produced by an earlier job.
+
+```yaml
+steps:
+  - uses: domengabrovsek/github-actions/.github/actions/download-artifact@main
+    with:
+      name: dist
+      path: dist/
+```
+
+## Inputs
+
+| Input | Default | Description |
+|-------|---------|-------------|
+| `name` | all artifacts | Name of the artifact to download. Empty downloads every artifact from the run. |
+| `path` | working dir | Destination directory. |
+| `pattern` | `''` | Glob of artifact names to download when `name` is empty. |
+| `merge-multiple` | `false` | Merge downloads into one directory instead of a subdir each. |
+| `github-token` | `''` | Token for downloading from another repo or run. Empty stays within the current run. |
+| `repository` | current repo | Repo to download from. Used only with `github-token`. |
+| `run-id` | current run | Run ID to download from. Used only with `github-token`. |
+
+## Outputs
+
+| Output | Description |
+|--------|-------------|
+| `download-path` | Absolute path the artifacts were downloaded to. |
+
+## Notes
+
+- Pins `download-artifact` to a single SHA in [`.github/actions/download-artifact/action.yml`](../../.github/actions/download-artifact/action.yml).
+- Pinned to v8. Repos on v4 should test on adoption - artifact v5+ carried breaking changes.
diff --git a/docs/actions/upload-artifact.md b/docs/actions/upload-artifact.md
new file mode 100644
index 0000000..37526a3
--- /dev/null
+++ b/docs/actions/upload-artifact.md
@@ -0,0 +1,37 @@
+# `upload-artifact`
+
+Thin wrapper around [`actions/upload-artifact`](https://github.com/actions/upload-artifact), SHA-pinned centrally so every repo tracks the same version via `@main`. Uploads files as a workflow artifact, e.g. to hand a build to a later job.
+
+```yaml
+steps:
+  - uses: domengabrovsek/github-actions/.github/actions/upload-artifact@main
+    with:
+      name: dist
+      path: dist/
+      retention-days: 1
+```
+
+## Inputs
+
+| Input | Default | Description |
+|-------|---------|-------------|
+| `path` | required | File, directory, or wildcard pattern to upload. |
+| `name` | `artifact` | Artifact name. |
+| `if-no-files-found` | `warn` | Behavior when nothing matches `path` (`warn`, `error`, `ignore`). |
+| `retention-days` | repo default | Days to keep the artifact. |
+| `compression-level` | `6` | Zip compression, 0 (none) to 9 (best). |
+| `overwrite` | `false` | Delete an existing artifact of the same name first. |
+| `include-hidden-files` | `false` | Include dotfiles. |
+
+## Outputs
+
+| Output | Description |
+|--------|-------------|
+| `artifact-id` | GitHub ID of the uploaded artifact. |
+| `artifact-url` | Download URL in the run UI. |
+| `artifact-digest` | SHA-256 digest of the artifact. |
+
+## Notes
+
+- Pins `upload-artifact` to a single SHA in [`.github/actions/upload-artifact/action.yml`](../../.github/actions/upload-artifact/action.yml).
+- Pinned to v7. Repos on v4 should test on adoption - artifact v5+ carried breaking changes (immutable artifacts, no re-upload to the same name).