diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a5d1fb4..d05c65d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -34,12 +34,18 @@ jobs:
           ARCHIVE=$(find .docc-build -name 'Rostrum.doccarchive' -print -quit)
           "$(xcrun --find docc)" process-archive transform-for-static-hosting \
             "$ARCHIVE" --output-path site --hosting-base-path rostrum
-      # Deliberately still v3. It is a composite action wrapping
-      # actions/upload-artifact@v4, so unlike checkout and deploy-pages it
-      # carries no Node 20 deprecation. v4 dropped dotfiles from the artifact
-      # — a silent change for a directory we do not fully control, since
-      # `transform-for-static-hosting` decides what lands in `site`.
-      - uses: actions/upload-pages-artifact@v3
+      # v5, not v3. v3 is a composite wrapping upload-artifact@v4, which is
+      # itself Node 20 — the deprecation hides one level down and does not
+      # show up when grepping this file for action versions. v5 pins
+      # upload-artifact@v7 (Node 24).
+      #
+      # v4 introduced one behaviour change worth knowing about: dotfiles are
+      # no longer included unless `include-hidden-files: true`. We do not set
+      # it, having checked the published artifact rather than assuming — all
+      # 4,914 entries produced by `transform-for-static-hosting` are visible
+      # files, so the default costs us nothing. If DocC ever starts emitting
+      # one, that input is the fix.
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
   deploy: