diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 5bc9fbf043..a3847d792f 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -2,59 +2,74 @@ name: Pull request
 
 on: pull_request
 
+permissions:
+  contents: read      # Read access for checkout
+
 jobs:
   build:
     name: Build docs
     runs-on: ubuntu-24.04-4core
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+
       - name: Editor config
         uses: snow-actions/eclint@v1.0.1
         continue-on-error: true
+
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: "~1.23"
+          go-version-file: go.mod
+
       - name: Get Go module cache directory path
         id: go-module-cache-dir-path
-        run: echo "::set-output name=dir::$(go env GOMODCACHE)"
+        run: echo "dir=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
+
       - name: Initialize Go module cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-module-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
+
       - name: Download Go dependencies
         run: make go.deps
+
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: "~16"
+          node-version: "~20"
+
       - name: Get Yarn cache directory path
         id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(npx yarn cache dir)"
+        run: echo "dir=$(npx yarn cache dir)" >> $GITHUB_OUTPUT
+
       - name: Initialize Yarn module cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-yarn-
+
       - name: Download Yarn dependencies
         run: make js.deps
+
       - name: Initialize Hugo binary cache
         id: cache-hugo
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: hugo.linux
           key: ${{ runner.os }}-hugo-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-hugo-
+
       - name: Build Hugo binary
         if: steps.cache-hugo.outputs.cache-hit != 'true'
         run: make hugo.linux
+
       - name: Build docs
         run: make build.public
         env:
@@ -68,3 +83,10 @@ jobs:
           HUGO_PARAMS_SEARCH_APIKEY: ${{ secrets.HUGO_PARAMS_SEARCH_APIKEY }}
           HUGO_PARAMS_SEARCH_ENABLED: true
           HUGO_PARAMS_SEARCH_INDEX: thethingsstack
+
+      - name: Validate build output
+        run: |
+          if [ ! -d "public" ]; then
+            echo "Error: Build output directory 'public' not found"
+            exit 1
+          fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20cb1294ea..942b5b8288 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,58 +5,74 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read      # Read access for checkout
+  pages: write        # Write access to deploy to GitHub Pages
+
 jobs:
   release:
     name: Release docs
     runs-on: ubuntu-24.04-4core
+    timeout-minutes: 10
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: "~1.23"
+          go-version-file: go.mod
+
       - name: Get Go module cache directory path
         id: go-module-cache-dir-path
-        run: echo "::set-output name=dir::$(go env GOMODCACHE)"
+        run: echo "dir=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
+
       - name: Initialize Go module cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-module-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
+
       - name: Download Go dependencies
         run: make go.deps
+
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: "~16"
+          node-version: "~20"
+
       - name: Get Yarn cache directory path
         id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(npx yarn cache dir)"
+        run: echo "dir=$(npx yarn cache dir)" >> $GITHUB_OUTPUT
+
       - name: Initialize Yarn module cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-yarn-
+
       - name: Download Yarn dependencies
         run: make js.deps
+
       - name: Initialize Hugo binary cache
         id: cache-hugo
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: hugo.linux
           key: ${{ runner.os }}-hugo-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-hugo-
+
       - name: Build Hugo binary
         if: steps.cache-hugo.outputs.cache-hit != 'true'
         run: make hugo.linux
+
       - name: Build docs
         run: make build.public
         env:
@@ -71,14 +87,35 @@ jobs:
           HUGO_PARAMS_SEARCH_APIKEY: ${{ secrets.HUGO_PARAMS_SEARCH_APIKEY }}
           HUGO_PARAMS_SEARCH_ENABLED: true
           HUGO_PARAMS_SEARCH_INDEX: thethingsstack
+
+      - name: Validate build output
+        run: |
+          if [ ! -d "public" ]; then
+            echo "Error: Build output directory 'public' not found"
+            exit 1
+          fi
+
       - name: Deploy documentation to Github pages
-        uses: JamesIves/github-pages-deploy-action@releases/v4
+        uses: JamesIves/github-pages-deploy-action@v4
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: gh-pages
-          FOLDER: public
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: gh-pages
+          folder: public
+
       - name: Make gateways.csv
         run: make gateways.csv
+        continue-on-error: true
+
       - name: Sync gateways.csv to airtable
+        if: success() || failure()
         run: |
-          curl -X POST ${{ secrets.AIRTABLE_GATEWAYS_API_ENDPOINT }} -H "Authorization: Bearer ${{ secrets.AIRTABLE_GATEWAYS_API_KEY }}" -H "Content-Type: text/csv" --data-binary "@gateways.csv"
+          if [ ! -f gateways.csv ]; then
+            echo "Warning: gateways.csv not found, skipping sync"
+            exit 0
+          fi
+          curl -f -X POST ${{ secrets.AIRTABLE_GATEWAYS_API_ENDPOINT }} \
+            -H "Authorization: Bearer ${{ secrets.AIRTABLE_GATEWAYS_API_KEY }}" \
+            -H "Content-Type: text/csv" \
+            --data-binary "@gateways.csv" \
+            --fail-with-body
+        continue-on-error: true