diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3084a2..81e5df2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,8 @@ jobs:
     name: Lint and type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
       - name: Install dependencies
@@ -34,8 +34,8 @@ jobs:
     name: Unit and contract tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
       - name: Install dependencies
@@ -47,8 +47,8 @@ jobs:
     name: Production build and end-to-end verification
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
       - name: Install dependencies
diff --git a/README.md b/README.md
index c9c411e..9e59617 100644
--- a/README.md
+++ b/README.md
@@ -148,14 +148,25 @@ PASS  an unreachable API does not render bookmarks
 40/40 checks passed
 ```
 
+## Continuous integration
+
+`.github/workflows/ci.yml` runs on every push and pull request to `main`, and can be started by hand from the Actions tab. It has three jobs that run in parallel on Node 22:
+
+| Job | Runs |
+|---|---|
+| Lint and type check | `npm run lint`, `npm run typecheck` |
+| Unit and contract tests | `npm test` |
+| Production build and end-to-end verification | `npm run build`, `npm run verify:e2e` |
+
 ## What was not verified
 
 - **The real API.** The app has never run against `django-ninja-mongo-api` with a live MongoDB. The mock in `mock-api/server.mjs` was written by reading that API's routers and schemas, so it can drift from the real service.
 - **A browser.** None was available. Hydration, the pending state of `useActionState` forms, how React resets a form after a client-side submit, visual rendering, dark mode, the responsive layout and keyboard focus order were not exercised. The HTTP-level checks cover the no-JavaScript path.
 - **The session check inside each Server Function, in isolation.** `proxy.ts` matches the same paths, so a request without a cookie is redirected before a Server Function runs. The forged-cookie scenario does exercise the API-rejection path; the in-function check itself is covered by reading the code, not by a request.
-- **The GitHub Actions workflow.** `.github/workflows/ci.yml` runs the same commands as above on Node 22. The commands were run locally, including from a clean copy without a lockfile; the workflow itself is only as verified as its run history on the Actions tab.
 - **`npm run dev` beyond a smoke test.** It was started and `/login` and the proxy redirect were checked; the full flow was verified on the production build.
 
+What has been observed on GitHub: the first CI run on `main` passed in all three jobs, and the job logs show the same results as the local runs above (59 tests, 40/40 end-to-end checks). The run history on the Actions tab is the source of truth for anything after that.
+
 ## Dependency pinning
 
 Direct dependencies are pinned to exact versions in `package.json` (`.npmrc` sets `save-exact`). There is **no `package-lock.json`** in the repository, so transitive dependencies resolve at install time.