diff --git a/.gitea/workflows/p0a-ci.yml b/.gitea/workflows/p0a-ci.yml
index 0070b02..a999056 100644
--- a/.gitea/workflows/p0a-ci.yml
+++ b/.gitea/workflows/p0a-ci.yml
@@ -41,7 +41,7 @@ jobs:
         shell: powershell
         run: pnpm package:portable
       - name: Upload candidate package and evidence
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: dada-p0a-candidate-${{ gitea.sha }}
           path: |
diff --git a/scripts/verify-ci-isolation.mjs b/scripts/verify-ci-isolation.mjs
index 9dab200..8b47070 100644
--- a/scripts/verify-ci-isolation.mjs
+++ b/scripts/verify-ci-isolation.mjs
@@ -22,6 +22,8 @@ assert.match(workflow, /pnpm install --frozen-lockfile/);
 assert.match(workflow, /DADA_EXTERNAL_MODE:\s*mock/);
 assert.match(workflow, /pnpm test:all/);
 assert.match(workflow, /pnpm package:portable/);
+assert.match(workflow, /uses:\s+actions\/upload-artifact@v3\b/);
+assert.doesNotMatch(workflow, /uses:\s+actions\/upload-artifact@v(?:[4-9]|\d{2,})\b/);
 
 const forbiddenEnvironment = [
   "DADA_LOCAL_DATA_ROOT",