diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f972564f8..a2cfb7859 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,10 +8,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: 24.x
 
@@ -32,10 +32,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: 24.x
 
@@ -47,7 +47,7 @@ jobs:
       run: npm run test-ci
 
     - name: Coverage
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@v2
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -60,10 +60,10 @@ jobs:
         node: [14.x, 16.x, 18.x, 20.x, 22.x, 24.x]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ matrix.node }}
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d6fcfc09d..6ed2f9bc4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -13,11 +13,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ secrets.DOCKERHUB_ACCOUNT }}/hsd
@@ -26,32 +26,32 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest,enable=${{ github.ref != 'refs/heads/master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
             type=edge
           flavor: |
             latest=false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index da39bf549..36ad5bacf 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -8,15 +8,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@v7
+    - uses: actions/setup-node@v7
       with:
-          node-version: 16.x
+          node-version: 24.x
     - run: |
         npm install -g @hns-dev/bsdoc
         jsdoc -c jsdoc.json
     - name: Deploy
-      uses: peaceiris/actions-gh-pages@v3
+      uses: peaceiris/actions-gh-pages@v4
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: ./docs/reference
diff --git a/Dockerfile b/Dockerfile
index 057597551..88b99addd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,16 +1,29 @@
-FROM node:18-alpine AS base
+FROM node:24-alpine AS base
 WORKDIR /opt/hsd
 RUN apk add --no-cache bash unbound-dev gmp-dev
 COPY package.json /opt/hsd
 
 # Install build dependencies and compile.
 FROM base AS build
-RUN apk add --no-cache g++ gcc make python3
+RUN apk add --no-cache g++ gcc make python3 git
 RUN npm install --omit=dev
 
+# handover plugin: HNSDNS/handover @ nsec-ds. Its peers resolve against
+# hsd's node_modules. The sources are plain TypeScript relying on Node 24
+# type stripping, and Node won't strip types for .ts under a node_modules
+# directory, so it can't go in /opt/hsd/node_modules directly. It lives next
+# to hsd instead; the final stage symlinks it into node_modules so `loader:
+# require` can resolve the module name `handover`, while realpath resolution
+# keeps TS stripping happy.
+RUN git clone --depth 1 https://github.com/HNSDNS/handover.git /opt/hsd/handover \
+    && cd /opt/hsd/handover \
+    && npm install --omit=dev
+
 FROM base
 ENV PATH="${PATH}:/opt/hsd/bin:/opt/hsd/node_modules/.bin"
 COPY --from=build /opt/hsd/node_modules /opt/hsd/node_modules/
+COPY --from=build /opt/hsd/handover /opt/hsd/handover/
+RUN ln -s ../handover /opt/hsd/node_modules/handover
 COPY bin /opt/hsd/bin/
 COPY lib /opt/hsd/lib/
 ENTRYPOINT ["hsd"]