diff --git a/.github/workflows/code-documentation.yml b/.github/workflows/code-documentation.yml
index 3369410f..6fe16448 100644
--- a/.github/workflows/code-documentation.yml
+++ b/.github/workflows/code-documentation.yml
@@ -464,9 +464,11 @@ jobs:
       - name: Set up Node.js
         if: github.event_name != 'pull_request' || steps.refresh.outputs.build == 'true'
         continue-on-error: ${{ github.event_name == 'pull_request' }}
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
+          # v5+ caches automatically when it finds a package manager; this job never did.
+          package-manager-cache: false
 
       # The command is CODE_GRAPH_INSTALL_COMMAND (lib/config/code-graph-workflow.ts),
       # the one spelling both workflows use: pinned wasm tree-sitter + grammars +
@@ -1663,9 +1665,11 @@ jobs:
           fi
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
+          # v5+ caches automatically when it finds a package manager; this job never did.
+          package-manager-cache: false
 
       # =========================================================================
       # STAGE 0: CODE GRAPH (same build as the standalone code-graph job above)
@@ -1974,7 +1978,7 @@ jobs:
 
       - name: Set up Python 3.12
         if: contains(env.STAGES, 'codewiki') && steps.detect_language.outputs.codewiki_supported == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
@@ -3171,6 +3175,12 @@ jobs:
           elif [ "$JOB_STATUS" != "success" ]; then
             STATUS="failure"
             REASON="the job status is $JOB_STATUS"
+          # A requested stage that FAILED fails the run, whatever the others wrote:
+          # a run whose stages 3 and 4 wrote nothing used to report success because
+          # stage 2 had committed reference docs.
+          elif FAILED_STAGES=$(for n in 1 2 3 4; do v="STAGE${n}_STATUS"; [ "${!v}" = "failed" ] && printf 'stage %s, ' "$n"; done) && [ -n "$FAILED_STAGES" ]; then
+            STATUS="failure"
+            REASON="${FAILED_STAGES%, } failed"
           # Check if we have any documentation changes
           elif [ "$HAS_CHANGES" != "true" ]; then
             STATUS="no_changes"