diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a21d64d..e495d18 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,3 +1,6 @@
+# Deploy — files over rsync. Runs on every push to main and on manual
+# dispatch, because scripts are not versioned — they go live immediately.
+# Requires secrets: DEPLOY_HOST, DEPLOY_USER, DEPLOY_PATH, DEPLOY_PASSWORD.
 name: Deploy
 
 on:
@@ -9,7 +12,7 @@ jobs:
   deploy:
     runs-on: alpine
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Generate SHA256SUMS
         run: sha256sum *.py > SHA256SUMS