diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb62910..c70151e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,8 +37,8 @@ jobs:
       TEST_DATABASE_URL: postgresql://horaires:horaires@localhost:5432/horaires_test?schema=public
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: npm
@@ -74,8 +74,8 @@ jobs:
       TEST_DATABASE_URL: postgresql://horaires:horaires@localhost:5432/horaires_e2e?schema=public
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: npm
@@ -85,7 +85,7 @@ jobs:
       # The runner can install the system packages a local machine cannot.
       - run: npx playwright install --with-deps chromium
       - run: npm run e2e
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report
@@ -96,10 +96,10 @@ jobs:
     name: Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
       - name: Build the runtime image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: false
diff --git a/playwright.config.ts b/playwright.config.ts
index a7bfb61..f576775 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -72,6 +72,11 @@ export default defineConfig({
       AUTH_URL: BASE_URL,
       AUTH_SECRET: E2E_AUTH_SECRET,
       AUTHENTIK_ADMIN_GROUP: 'horaires-admins',
+      // The harness serves over plain http on localhost, so the device routes
+      // would refuse every request. The refusal itself is covered by the unit
+      // tests in lib/device/transport.test.ts, where the transport can be
+      // varied per request instead of per server.
+      DEVICE_ALLOW_HTTP: 'true',
       // Placeholders, never contacted: the suite mints its own session cookie.
       // They exist so the provider builds and the sign-in page renders its
       // normal button — CI has no .env to inherit these from.