diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 08d9c95..eb144cb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }}
     permissions:
       actions: read
       contents: read
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/k8s-build.yml b/.github/workflows/k8s-build.yml
index 52bdb16..4670aa9 100644
--- a/.github/workflows/k8s-build.yml
+++ b/.github/workflows/k8s-build.yml
@@ -11,7 +11,7 @@ permissions:
   packages: write
 jobs:
   build:
-    runs-on: ${{ vars.RUNNER_LINUX_X64_8 || vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }}
+    runs-on: ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
@@ -20,9 +20,9 @@ jobs:
             dockerfile: website/Dockerfile.everk8s
             context: website
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -35,7 +35,7 @@ jobs:
             main|master) echo "tag=prod" >> "$GITHUB_OUTPUT" ;;
             *) echo "tag=${GITHUB_REF_NAME//\//-}" >> "$GITHUB_OUTPUT" ;;
           esac
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
diff --git a/website/Dockerfile.everk8s b/website/Dockerfile.everk8s
index ea86970..1f4938f 100644
--- a/website/Dockerfile.everk8s
+++ b/website/Dockerfile.everk8s
@@ -41,4 +41,7 @@ FROM nginx:alpine
 # so the stock nginx config serves it correctly — no SPA fallback needed.
 COPY --from=build /app/build /usr/share/nginx/html
 
+# Serve directory redirects RELATIVE, not absolute. See nginx-default.conf for why.
+COPY nginx-default.conf /etc/nginx/conf.d/default.conf
+
 EXPOSE 80
diff --git a/website/docusaurus.config.ts b/website/docusaurus.config.ts
index baea4fb..5057a68 100644
--- a/website/docusaurus.config.ts
+++ b/website/docusaurus.config.ts
@@ -49,24 +49,23 @@ const config: Config = {
   // Even if you don't use internationalization, you can use this field to set
   // useful metadata like html lang. For example, if your site is Chinese, you
   // may want to replace "en" with "zh-Hans".
+  // Locales advertised to visitors.
+  //
+  // Docusaurus renders a language dropdown for EVERY locale listed here, but the Docker build runs
+  // yarn run v1.22.22
+info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. and so only emits English. The other twelve were linked from every page
+  // and all returned 404 -- 144 dead URLs, found by a crawl of docs.ever.co on 2026-08-30.
+  //
+  // Translation sources for all thirteen exist under docs/i18n, so nothing is lost here. To turn one
+  // back on it must be BOTH listed below AND built: drop the  flag in
+  // Dockerfile.everk8s (which builds every declared locale) or pass that locale explicitly. Adding a
+  // locale here alone just recreates the 404s.
   i18n: {
     path: "./docs/i18n/",
     defaultLocale: "en",
-    locales: [
-      "en",
-      "fr",
-      "ar",
-      "bg",
-      "zh",
-      "nl",
-      "de",
-      "he",
-      "it",
-      "pl",
-      "pt",
-      "ru",
-      "es",
-    ],
+    locales: ["en"],
+    // Ready to re-enable once they are built:
+    // "fr", "ar", "bg", "zh", "nl", "de", "he", "it", "pl", "pt", "ru", "es"
   },
 
   presets: [
diff --git a/website/nginx-default.conf b/website/nginx-default.conf
new file mode 100644
index 0000000..57acb50
--- /dev/null
+++ b/website/nginx-default.conf
@@ -0,0 +1,31 @@
+# Static server for the built Docusaurus site.
+#
+# This is the stock nginx:alpine default.conf plus one line: absolute_redirect off.
+#
+# nginx defaults to absolute_redirect on, so when it issues the trailing-slash redirect for a
+# directory it rebuilds a full URL from the Host header and its own listen port. It has no idea TLS
+# was terminated upstream by Cloudflare, so it answers with http://. That turned every directory URL
+# on docs.ever.co into a three-hop chain with a protocol downgrade in the middle:
+#
+#     https://docs.ever.co/help   ->  301  http://docs.ever.co/help/     (nginx, downgraded)
+#     http://docs.ever.co/help/   ->  301  https://docs.ever.co/help/    (Cloudflare, back up)
+#
+# Search engines treat redirect chains as a ranking negative and the http hop is a real downgrade.
+# With absolute_redirect off nginx emits a relative `Location: /help/`, and the client keeps
+# whatever scheme it arrived on -- one hop, no downgrade, no dependence on knowing the public scheme.
+server {
+    listen       80;
+    server_name  localhost;
+
+    absolute_redirect off;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}