diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 15c29f6b..571e5ad0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
     container:
       image: swift:${{ matrix.swift }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Oracle tests shell out to these; the pure-Swift suite passes without them.
       # fonts-dejavu-core feeds the real-font sanity oracle in FontMetricsTests.
       - name: Install oracle tools
@@ -80,7 +80,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Swift version
         run: swift --version
       - name: Test Rostrum (Darwin XML branch)
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7cd4737b..a5d1fb48 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ jobs:
   build:
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build DocC archive
         run: |
           xcodebuild docbuild -scheme Rostrum \
@@ -34,6 +34,11 @@ jobs:
           ARCHIVE=$(find .docc-build -name 'Rostrum.doccarchive' -print -quit)
           "$(xcrun --find docc)" process-archive transform-for-static-hosting \
             "$ARCHIVE" --output-path site --hosting-base-path rostrum
+      # Deliberately still v3. It is a composite action wrapping
+      # actions/upload-artifact@v4, so unlike checkout and deploy-pages it
+      # carries no Node 20 deprecation. v4 dropped dotfiles from the artifact
+      # — a silent change for a directory we do not fully control, since
+      # `transform-for-static-hosting` decides what lands in `site`.
       - uses: actions/upload-pages-artifact@v3
         with:
           path: site
@@ -45,4 +50,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5