diff --git a/.gitea/workflows/build-release.yml b/.gitea/workflows/build-release.yml
index 3ff8bd5..ecbdebf 100644
--- a/.gitea/workflows/build-release.yml
+++ b/.gitea/workflows/build-release.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Package appstore artifact
         run: make appstore
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v3
         with:
           name: workflow_deck_automation-${{ gitea.ref_name }}
           path: build/artifacts/appstore/*.tar.gz
diff --git a/CLAUDE.md b/CLAUDE.md
index 203cd9c..3537e5d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -51,6 +51,8 @@ There is no meaningful way to test the Deck integration itself outside a real Ne
 
 **If the tagged build fails and no artifact was ever produced**, fix the issue on `main` and *move* the existing tag to the fixed commit instead of bumping to a new version number (`git tag -d vX.Y.Z && git tag -a vX.Y.Z -m "..." && git push origin :refs/tags/vX.Y.Z && git push origin vX.Y.Z`) — this is how `v0.1.0` was handled through several `build-release.yml` fixes before it first built successfully. Once a version has actually produced a published artifact, don't move its tag anymore; bump normally instead.
 
+**`actions/upload-artifact` must stay on `@v3`, not `@v4`+.** This self-hosted Gitea instance identifies as GHES to the official `actions/*` JS actions, which refuse to run `@actions/artifact` v2.0.0+ (used internally by `upload-artifact@v4` and later) against GHES: `GHESNotSupportedError`. `actions/checkout` and `actions/setup-node` don't have this problem and can be kept on their latest majors — only the artifact upload/download actions are affected, because they're the ones that talk to a version-specific backend API rather than just running local commands.
+
 ## Data flow / architecture map
 
 - **UI**: `src/PersonalSettings.vue` (Vue 3, mounted from `templates/settings/personal.php` into the section registered by `lib/Settings/PersonalSection.php` + `lib/Settings/Personal.php`) talks to `lib/Controller/WorkflowController.php` (an `OCSController`) via `src/api.js`, hitting OCS routes declared in `appinfo/routes.php` (`/ocs/v2.php/apps/workflow_deck_automation/api/v1/...`).