diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e948696..ac676cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,11 +14,11 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
       - run: python -m pip install -e ".[dev]"
@@ -57,14 +57,14 @@ jobs:
           - language: javascript
             image: node:22-slim
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: python -m pip install .
       - run: docker pull ${{ matrix.image }}
       - run: evalarc audit --task ${{ matrix.task }} --language ${{ matrix.language }} --image ${{ matrix.image }} --seeds 17 --output runs/docker-audit
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: grader-audit-${{ matrix.task }}-${{ matrix.language }}
@@ -72,11 +72,11 @@ jobs:
   site:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -97,24 +97,24 @@ jobs:
         run: |
           python -m pip install --quiet .
           node scripts/check_reports_browser.cjs
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: evidence-site
           path: dist/site/
           include-hidden-files: true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: evidence-casebook
           path: dist/casebook/
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: independent-swe-dataset
           path: dist/independent-swe-dataset/
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: A higher headline score with regressed checks fails the action
@@ -245,8 +245,8 @@ jobs:
   strands-recipe:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -273,15 +273,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: test "$(gh api repos/$GITHUB_REPOSITORY/git/ref/heads/main --jq .object.sha)" = "$GITHUB_SHA"
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: evidence-site
           path: site
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
-      - uses: actions/deploy-pages@v4
+          # v4+ drops dotfiles by default; the published behavior-audit evidence lists
+          # node_modules/.pnpm/lock.yaml in its manifest, so keep hidden files.
+          include-hidden-files: true
+      - uses: actions/deploy-pages@v5
         id: deployment
   huggingface:
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' && github.repository == 'noteflowai/evalarc'
@@ -291,19 +294,19 @@ jobs:
       group: huggingface
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: evidence-site
           path: dist/site
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: evidence-casebook
           path: dist/casebook
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: independent-swe-dataset
           path: dist/independent-swe-dataset
@@ -318,7 +321,7 @@ jobs:
           python scripts/publish_space.py --bundle dist/site
           python scripts/publish_dataset.py --bundle dist/casebook
           python scripts/swe_dataset.py --publish --output dist/independent-swe-dataset
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 065cb9e..f1b3360 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -24,11 +24,11 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: refs/tags/${{ inputs.tag }}
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Download the release distributions and check their digests
@@ -55,7 +55,7 @@ jobs:
           cd "$RUNNER_TEMP"
           PYTHONPATH="" "$RUNNER_TEMP/installed/bin/python" \
             "$GITHUB_WORKSPACE/scripts/check_installed.py" --source "$GITHUB_WORKSPACE"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: python-distributions
           path: dist/
@@ -69,7 +69,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: python-distributions
           path: dist/