diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index edba817..938d6f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,8 +17,8 @@ jobs:
       matrix:
         python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
           cache: pip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 616c04e..8286531 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,13 +11,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
       - run: python -m pip install --upgrade pip build
       - run: python -m build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -29,7 +29,7 @@ jobs:
     permissions:
       id-token: write   # required for Trusted Publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
diff --git a/wellmarked/async_client.py b/wellmarked/async_client.py
index 0320a66..bc0e6dd 100644
--- a/wellmarked/async_client.py
+++ b/wellmarked/async_client.py
@@ -3,14 +3,13 @@
 
 import asyncio
 import time
-from typing import Iterable, Optional, Union
+from typing import Iterable, Optional, Union, Any
 
 import httpx
 
 from ._base import (
     DEFAULT_BASE_URL,
     DEFAULT_TIMEOUT,
-    default_headers,
     merge_headers,
     parse_response,
     resolve_api_key,
@@ -192,7 +191,7 @@ async def rotate_webhook_secret(self) -> RotatedWebhookSecret:
 
     # ── Transport ─────────────────────────────────────────────────────────────
 
-    async def _request(self, method: str, path: str, *, json: object = None):
+    async def _request(self, method: str, path: str, *, json: object = None) -> Any:
         # See WellMarked._request for why we build absolute URLs ourselves.
         url = f"{self._base_url}{path}"
         try:
@@ -201,8 +200,9 @@ async def _request(self, method: str, path: str, *, json: object = None):
             raise wrap_transport_error(exc) from exc
 
         try:
-            body = response.json() if response.content else None
-        except ValueError:
+            assert response.content
+            body = response.json()
+        except (AssertionError, ValueError):
             body = None
 
         # httpx Headers is dict-like for our purposes; pass it through so
diff --git a/wellmarked/client.py b/wellmarked/client.py
index 2e4fbf0..b91d793 100644
--- a/wellmarked/client.py
+++ b/wellmarked/client.py
@@ -2,14 +2,13 @@
 from __future__ import annotations
 
 import time
-from typing import Iterable, Optional, Union
+from typing import Iterable, Optional, Union, Any
 
 import httpx
 
 from ._base import (
     DEFAULT_BASE_URL,
     DEFAULT_TIMEOUT,
-    default_headers,
     merge_headers,
     parse_response,
     resolve_api_key,
@@ -326,7 +325,7 @@ def rotate_webhook_secret(self) -> RotatedWebhookSecret:
 
     # ── Transport ─────────────────────────────────────────────────────────────
 
-    def _request(self, method: str, path: str, *, json: object = None):
+    def _request(self, method: str, path: str, *, json: object = None) -> Any:
         # Build absolute URLs ourselves rather than relying on httpx's base_url
         # join. That way a user-supplied http_client without a base_url still
         # works — important when the caller wants a custom transport/proxy.
@@ -337,8 +336,9 @@ def _request(self, method: str, path: str, *, json: object = None):
             raise wrap_transport_error(exc) from exc
 
         try:
-            body = response.json() if response.content else None
-        except ValueError:
+            assert response.content
+            body = response.json()
+        except (AssertionError, ValueError):
             body = None
 
         # httpx Headers is dict-like for our purposes; pass it through so