diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 780963080..dbd98b36c 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -39,10 +39,10 @@ jobs:
     name: Build site
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -57,9 +57,15 @@ jobs:
         working-directory: website
         run: npm run build
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: website/build
+          # v4 stopped bundling dotfiles, and Docusaurus writes a `.nojekyll`
+          # into website/build. The artifact-based Pages deploy never runs
+          # Jekyll, so losing it would probably be harmless — but "probably" is
+          # not worth finding out on the live site, and this restores exactly
+          # what v3 uploaded. `.git`/`.github` stay excluded either way.
+          include-hidden-files: true
 
   deploy:
     name: Deploy to GitHub Pages
@@ -76,4 +82,4 @@ jobs:
       id-token: write
     steps:
       - id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
\ No newline at end of file
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
\ No newline at end of file