diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5fff4a3..2696215 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,12 +13,12 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 20
+                  node-version: 24
             - run: npm ci
             - uses: wagoid/commitlint-github-action@v6
               env:
@@ -28,10 +28,10 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 20
+                  node-version: 24
             - run: npm ci
             - run: npm run lint
             - run: npm run tsc
@@ -42,10 +42,10 @@ jobs:
         needs: lint
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 20
+                  node-version: 24
             - run: npm ci
             - run: npm run test
 
@@ -55,15 +55,15 @@ jobs:
         needs: test
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 20
+                  node-version: 24
             - run: npm ci
             - run: npm run build
               env:
                   CI: true
-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@v7
               with:
                   name: dist
                   path: dist
@@ -72,35 +72,16 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/v')
         runs-on: ubuntu-latest
         needs: build
+        permissions:
+            contents: write
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-python@v5
-              with:
-                  python-version: 3.8
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v8
               with:
                   name: dist
-            - name: Prepare Release
-              run: |
-                  echo "USERSCRIPT_PATH=$(find . -type f -name '*.user.js')" >> $GITHUB_ENV
-                  echo "USERSCRIPT_NAME=$(find . -type f -name '*.user.js' -exec basename {} \;)" >> $GITHUB_ENV
-            - name: Create Release
-              id: create_release
-              uses: actions/create-release@v1
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
+                  path: dist
+            - name: Create draft release
+              uses: softprops/action-gh-release@v3
               with:
-                  tag_name: ${{ github.ref }}
-                  release_name: Release ${{ github.ref }}
                   draft: true
-                  prerelease: false
-            - name: Upload Release Asset (.user.js)
-              id: upload-release-asset-tar-gz
-              uses: actions/upload-release-asset@v1
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-              with:
-                  upload_url: ${{ steps.create_release.outputs.upload_url }}
-                  asset_path: ${{ env.USERSCRIPT_PATH }}
-                  asset_name: ${{ env.USERSCRIPT_NAME }}
-                  asset_content_type: application/javascript
+                  name: Release ${{ github.ref_name }}
+                  files: dist/*.user.js
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4055ff1..f78dc00 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,10 +9,10 @@ jobs:
     publish:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 20
+                  node-version: 24
             - name: Download release assets
               run: |
                   mkdir -p dist
diff --git a/ci/deploy.sh b/ci/deploy.sh
index f592332..7222490 100755
--- a/ci/deploy.sh
+++ b/ci/deploy.sh
@@ -1,12 +1,41 @@
 #!/usr/bin/env bash
+set -euo pipefail
 
 echo "Deploying on tw-calc.net..."
 
 VERSION="$(echo "$REF" | cut -d '/' -f3)"
 
-curl \
-  --form "apiKey=$TW_CALC_API_KEY" \
-  --form "version=$VERSION" \
-  --form "updateInfo=See <a href='https://github.com/The-West-Scripts/TW-Calc-Script/releases'>releases</a>." \
-  --form 'userscript=@./dist/TW_Calc.user.js' \
-  https://tw-calc.net/service/userscript-publish
+response_file="$(mktemp)"
+trap 'rm -f "$response_file"' EXIT
+
+# --fail-with-body makes curl exit non-zero on HTTP >= 400 while still capturing the
+# body, so a rejected publish can't masquerade as a successful (green) deploy.
+http_code="$(
+  curl \
+    --silent --show-error \
+    --fail-with-body \
+    --output "$response_file" \
+    --write-out '%{http_code}' \
+    --form "apiKey=$TW_CALC_API_KEY" \
+    --form "version=$VERSION" \
+    --form "updateInfo=See <a href='https://github.com/The-West-Scripts/TW-Calc-Script/releases'>releases</a>." \
+    --form 'userscript=@./dist/TW_Calc.user.js' \
+    https://tw-calc.net/service/userscript-publish
+)" || {
+  echo "::error::Publish request failed (HTTP ${http_code:-?})."
+  cat "$response_file"
+  exit 1
+}
+
+# The host (WEDOS Global Protection) can answer an automated request with an HTTP 200
+# anti-bot challenge page instead of running the publish — which previously looked like
+# a successful deploy. Treat a challenge/HTML response as a failure.
+if grep -qiE 'wedos|altcha|security verification|<!doctype html|<html' "$response_file"; then
+  echo "::error::Publish was intercepted by an anti-bot/challenge page instead of reaching the publish endpoint (HTTP ${http_code}). The script was NOT published."
+  echo "---- response (first 40 lines) ----"
+  head -n 40 "$response_file"
+  exit 1
+fi
+
+echo "Publish accepted (HTTP ${http_code}). Response:"
+cat "$response_file"