diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 421c2b0..7c3aa9c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a4662fb..e80ba46 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,9 +23,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm
@@ -38,9 +38,11 @@ jobs:
           npm run build -w website
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: website/build
+          # v4+ excludes dotfiles by default; Docusaurus needs .nojekyll.
+          include-hidden-files: true
 
   deploy:
     needs: build
@@ -50,4 +52,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/know-code.yml b/.github/workflows/know-code.yml
index bf0d7cb..4c1dc33 100644
--- a/.github/workflows/know-code.yml
+++ b/.github/workflows/know-code.yml
@@ -11,14 +11,14 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           # Default pull_request checkout is a merge commit (no trailers).
           # Verify must run on the PR tip that carries Know-Code-Verified.
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4ad7b3..0406656 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,12 +20,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: npm-release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       # Node 24 → npm ≥ 11.5.1 (required for trusted publishing).
       # Do NOT set registry-url: setup-node would inject a dummy NODE_AUTH_TOKEN
       # that prevents the OIDC exchange (ENEEDAUTH).
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "24"
           package-manager-cache: false
diff --git a/.github/workflows/umami-proxy.yml b/.github/workflows/umami-proxy.yml
index 2874e7c..83bbfbb 100644
--- a/.github/workflows/umami-proxy.yml
+++ b/.github/workflows/umami-proxy.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Deploy Worker
         uses: cloudflare/wrangler-action@v4
diff --git a/action/action.yml b/action/action.yml
index ca9f217..4fd02fd 100644
--- a/action/action.yml
+++ b/action/action.yml
@@ -31,7 +31,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: "22"
 
diff --git a/packages/cli/src/commands-core.test.ts b/packages/cli/src/commands-core.test.ts
index d5b51f9..02e0df6 100644
--- a/packages/cli/src/commands-core.test.ts
+++ b/packages/cli/src/commands-core.test.ts
@@ -254,6 +254,7 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
     const yml = consumerWorkflowYaml("develop");
     assert.match(yml, /base-branch: develop/);
     assert.match(yml, /chtnnh\/know-code\/action@v0\.3\.0/);
+    assert.match(yml, /actions\/checkout@v5/);
     // Push-to-base has no merge-base ahead of HEAD — verify must be PR-only.
     assert.match(yml, /pull_request:/);
     assert.doesNotMatch(yml, /push:/);
diff --git a/packages/cli/src/commands/init.ts b/packages/cli/src/commands/init.ts
index 636c398..4d5365a 100644
--- a/packages/cli/src/commands/init.ts
+++ b/packages/cli/src/commands/init.ts
@@ -24,7 +24,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: \${{ github.event.pull_request.head.sha }}
diff --git a/website/docs/ci.md b/website/docs/ci.md
index e69d028..f250f35 100644
--- a/website/docs/ci.md
+++ b/website/docs/ci.md
@@ -23,7 +23,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}