diff --git a/artifact/repository.go b/artifact/repository.go
new file mode 100644
index 0000000..fb853ad
--- /dev/null
+++ b/artifact/repository.go
@@ -0,0 +1,91 @@
+package artifact
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"code.geekeey.de/actions/sdk"
+)
+
+// RepositoryArtifact is an artifact as returned by the repository-scoped
+// actions API (compatible with the GitHub artifact REST schema).
+type RepositoryArtifact struct {
+	Id                 int64  `json:"id"`
+	Name               string `json:"name"`
+	SizeInBytes        int64  `json:"size_in_bytes"`
+	ArchiveDownloadURL string `json:"archive_download_url"`
+	Expired            bool   `json:"expired"`
+}
+
+type ListRunArtifactsResponse struct {
+	TotalCount int64                `json:"total_count"`
+	Artifacts  []RepositoryArtifact `json:"artifacts"`
+}
+
+// RepositoryClient talks to the repository-scoped actions artifacts API. Unlike
+// Client, which is bound to the current run by the runtime token, this client
+// can address any run in any repository the token has access to.
+type RepositoryClient struct {
+	http *sdk.Client
+}
+
+// NewRepositoryClient returns a client for the actions API at base using the
+// given token. base is typically the value of GITHUB_API_URL.
+func NewRepositoryClient(base, token string) *RepositoryClient {
+	return &RepositoryClient{http: sdk.NewClient(base, token)}
+}
+
+func (c *RepositoryClient) ListRunArtifacts(ctx context.Context, owner, repo string, runID int64) (*ListRunArtifactsResponse, error) {
+	endpoint := fmt.Sprintf("/repos/%s/%s/actions/runs/%d/artifacts", owner, repo, runID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("accept", "application/json")
+
+	res, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if !sdk.HasContentType(res, "application/json") {
+		return nil, fmt.Errorf("content-type: %q should be %q",
+			res.Header.Get("content-type"), "application/json")
+	}
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(res.Body, 32*1024))
+		return nil, fmt.Errorf("list artifacts of %s/%s run %d failed: %s: %s",
+			owner, repo, runID, res.Status, string(body))
+	}
+
+	var out ListRunArtifactsResponse
+	if err := json.NewDecoder(io.LimitReader(res.Body, 1024*1024)).Decode(&out); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// DownloadArtifact downloads the zip archive of an artifact. The server
+// redirects to the signed blob URL, which the underlying client follows.
+func (c *RepositoryClient) DownloadArtifact(ctx context.Context, owner, repo string, artifactID int64) (io.ReadCloser, error) {
+	endpoint := fmt.Sprintf("/repos/%s/%s/actions/artifacts/%d/zip", owner, repo, artifactID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(res.Body, 32*1024))
+		res.Body.Close()
+		return nil, fmt.Errorf("download artifact %d failed: %s: %s", artifactID, res.Status, string(body))
+	}
+	return res.Body, nil
+}
diff --git a/artifact/repository_test.go b/artifact/repository_test.go
new file mode 100644
index 0000000..2bcc386
--- /dev/null
+++ b/artifact/repository_test.go
@@ -0,0 +1,128 @@
+package artifact
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestRepositoryClient_ListRunArtifacts(t *testing.T) {
+	t.Parallel()
+
+	var gotPath, gotAuth string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("content-type", "application/json")
+		_, _ = io.WriteString(w, `{"total_count":1,"artifacts":[{"id":7,"name":"foo","size_in_bytes":10,"expired":false}]}`)
+	}))
+	defer server.Close()
+
+	c := NewRepositoryClient(server.URL, "secret")
+	res, err := c.ListRunArtifacts(context.Background(), "owner", "repo", 42)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got, want := gotPath, "/repos/owner/repo/actions/runs/42/artifacts"; got != want {
+		t.Errorf("expected path %q to be %q", got, want)
+	}
+	if got, want := gotAuth, "Bearer secret"; got != want {
+		t.Errorf("expected Authorization %q to be %q", got, want)
+	}
+	if len(res.Artifacts) != 1 || res.Artifacts[0].Id != 7 || res.Artifacts[0].Name != "foo" {
+		t.Errorf("unexpected response: %+v", res)
+	}
+}
+
+func TestRepositoryClient_ListRunArtifacts_Error(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("content-type", "application/json")
+		http.Error(w, `{"message":"not found"}`, http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	c := NewRepositoryClient(server.URL, "secret")
+	if _, err := c.ListRunArtifacts(context.Background(), "owner", "repo", 42); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestRepositoryClient_DownloadArtifact(t *testing.T) {
+	t.Parallel()
+
+	const zip = "zip-bytes"
+	var gotPath string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		_, _ = io.WriteString(w, zip)
+	}))
+	defer server.Close()
+
+	c := NewRepositoryClient(server.URL, "secret")
+	body, err := c.DownloadArtifact(context.Background(), "owner", "repo", 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer body.Close()
+
+	if got, want := gotPath, "/repos/owner/repo/actions/artifacts/7/zip"; got != want {
+		t.Errorf("expected path %q to be %q", got, want)
+	}
+	data, err := io.ReadAll(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != zip {
+		t.Errorf("expected %q, got %q", zip, data)
+	}
+}
+
+func TestRepositoryClient_DownloadArtifact_Redirect(t *testing.T) {
+	t.Parallel()
+
+	blob := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, "redirected-zip")
+	}))
+	defer blob.Close()
+
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, blob.URL+"/blob", http.StatusFound)
+	}))
+	defer api.Close()
+
+	c := NewRepositoryClient(api.URL, "secret")
+	body, err := c.DownloadArtifact(context.Background(), "owner", "repo", 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer body.Close()
+
+	data, err := io.ReadAll(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != "redirected-zip" {
+		t.Errorf("expected %q, got %q", "redirected-zip", data)
+	}
+}
+
+func TestRepositoryClient_DownloadArtifact_Error(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "nope", http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	c := NewRepositoryClient(server.URL, "secret")
+	_, err := c.DownloadArtifact(context.Background(), "owner", "repo", 7)
+	if err == nil || !strings.Contains(err.Error(), "download artifact") {
+		t.Fatalf("expected download error, got %v", err)
+	}
+}