diff --git a/.github/workflows/codeberg-mirror.yml b/.github/workflows/codeberg-mirror.yml
index aba9eee..f6a8bf8 100644
--- a/.github/workflows/codeberg-mirror.yml
+++ b/.github/workflows/codeberg-mirror.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'jatinkrmalik/vocalinux'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/distro-test-matrix.yml b/.github/workflows/distro-test-matrix.yml
index d8d8be2..049f469 100644
--- a/.github/workflows/distro-test-matrix.yml
+++ b/.github/workflows/distro-test-matrix.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install basic dependencies
         run: |
diff --git a/.github/workflows/flatpak.yml b/.github/workflows/flatpak.yml
index 27097e0..ef0ac28 100644
--- a/.github/workflows/flatpak.yml
+++ b/.github/workflows/flatpak.yml
@@ -51,7 +51,7 @@ jobs:
       options: --privileged
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build and bundle
         uses: flatpak/flatpak-github-actions/flatpak-builder@v6
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 11d1638..f0375f4 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PR
-        uses: actions/labeler@v5
+        uses: actions/labeler@v6
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 305048e..1251835 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: main
           fetch-depth: 0
@@ -264,7 +264,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: main
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0125ab8..1e971f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -145,7 +145,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -210,7 +210,7 @@ jobs:
       url: https://pypi.org/project/vocalinux/
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -260,7 +260,7 @@ jobs:
 
       - name: Checkout code
         if: steps.aur.outputs.configured == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Bump PKGBUILD version
         if: steps.aur.outputs.configured == 'true'
@@ -287,14 +287,12 @@ jobs:
     name: Deploy Website
     runs-on: ubuntu-latest
     needs: [build-and-release, publish-pypi]
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24'
           cache: 'npm'
@@ -308,15 +306,15 @@ jobs:
         run: |
           VERSION=$(grep -oP '__version__\s*=\s*"\K[^"]+' src/vocalinux/version.py)
           echo "Syncing version: $VERSION"
-          # Update softwareVersion where JSON-LD currently lives
-          if grep -q '"softwareVersion": "' web/src/app/page.tsx; then
-            sed -i 's/"softwareVersion": "[^"]*"/"softwareVersion": "'"$VERSION"'"/' web/src/app/page.tsx
+          # JSON-LD uses unquoted JS keys: softwareVersion: "x.y.z"
+          if grep -qE 'softwareVersion:\s*"' web/src/app/page.tsx; then
+            sed -i 's/softwareVersion: "[^"]*"/softwareVersion: "'"$VERSION"'"/' web/src/app/page.tsx
             echo "Updated page.tsx version:"
-            grep -oP '"softwareVersion":\s*"\K[^"]+' web/src/app/page.tsx
-          elif grep -q '"softwareVersion": "' web/src/app/layout.tsx; then
-            sed -i 's/"softwareVersion": "[^"]*"/"softwareVersion": "'"$VERSION"'"/' web/src/app/layout.tsx
+            grep -oP 'softwareVersion:\s*"\K[^"]+' web/src/app/page.tsx
+          elif grep -qE 'softwareVersion:\s*"' web/src/app/layout.tsx; then
+            sed -i 's/softwareVersion: "[^"]*"/softwareVersion: "'"$VERSION"'"/' web/src/app/layout.tsx
             echo "Updated layout.tsx version:"
-            grep -oP '"softwareVersion":\s*"\K[^"]+' web/src/app/layout.tsx
+            grep -oP 'softwareVersion:\s*"\K[^"]+' web/src/app/layout.tsx
           else
             echo "::warning::No softwareVersion field found in page.tsx or layout.tsx; skipping sync"
           fi
diff --git a/.github/workflows/unified-pipeline.yml b/.github/workflows/unified-pipeline.yml
index 3b3e4af..199a696 100644
--- a/.github/workflows/unified-pipeline.yml
+++ b/.github/workflows/unified-pipeline.yml
@@ -25,7 +25,7 @@ jobs:
       python: ${{ steps.filter.outputs.python }}
       deploy_website: ${{ steps.deploy_check.outputs.deploy }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -68,7 +68,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.python == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -105,7 +105,7 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.13']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -184,7 +184,7 @@ jobs:
           - arch: aarch64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -242,12 +242,12 @@ jobs:
     needs: changes
     if: needs.changes.outputs.deploy_website == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: './web/package-lock.json'
 
@@ -259,15 +259,15 @@ jobs:
         run: |
           VERSION=$(grep -oP '__version__\s*=\s*"\K[^"]+' src/vocalinux/version.py)
           echo "Syncing version: $VERSION"
-          # Update softwareVersion where JSON-LD currently lives
-          if grep -q '"softwareVersion": "' web/src/app/page.tsx; then
-            sed -i 's/"softwareVersion": "[^"]*"/"softwareVersion": "'"$VERSION"'"/' web/src/app/page.tsx
+          # JSON-LD uses unquoted JS keys: softwareVersion: "x.y.z"
+          if grep -qE 'softwareVersion:\s*"' web/src/app/page.tsx; then
+            sed -i 's/softwareVersion: "[^"]*"/softwareVersion: "'"$VERSION"'"/' web/src/app/page.tsx
             echo "Updated page.tsx version:"
-            grep -oP '"softwareVersion":\s*"\K[^"]+' web/src/app/page.tsx
-          elif grep -q '"softwareVersion": "' web/src/app/layout.tsx; then
-            sed -i 's/"softwareVersion": "[^"]*"/"softwareVersion": "'"$VERSION"'"/' web/src/app/layout.tsx
+            grep -oP 'softwareVersion:\s*"\K[^"]+' web/src/app/page.tsx
+          elif grep -qE 'softwareVersion:\s*"' web/src/app/layout.tsx; then
+            sed -i 's/softwareVersion: "[^"]*"/softwareVersion: "'"$VERSION"'"/' web/src/app/layout.tsx
             echo "Updated layout.tsx version:"
-            grep -oP '"softwareVersion":\s*"\K[^"]+' web/src/app/layout.tsx
+            grep -oP 'softwareVersion:\s*"\K[^"]+' web/src/app/layout.tsx
           else
             echo "::warning::No softwareVersion field found in page.tsx or layout.tsx; skipping sync"
           fi
@@ -299,13 +299,11 @@ jobs:
       github.ref == 'refs/heads/main' &&
       needs.changes.outputs.deploy_website == 'true' &&
       needs.web-build.result == 'success'
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24'
           cache: 'npm'
diff --git a/web/next.config.js b/web/next.config.js
index 70b22b6..992156e 100644
--- a/web/next.config.js
+++ b/web/next.config.js
@@ -6,30 +6,9 @@ const config = {
 	// Configuration for custom domain deployment
 	distDir: 'out',
 
-	// Configure cache headers for static assets
-	// This generates a _headers file for platforms like Netlify/Vercel
-	async headers() {
-		return [
-			{
-				source: '/_next/static/:path*',
-				headers: [
-					{
-						key: 'Cache-Control',
-						value: 'public, max-age=31536000, immutable',
-					},
-				],
-			},
-			{
-				source: '/:all*(svg|jpg|jpeg|png|webp|avif|ico|woff|woff2)',
-				headers: [
-					{
-						key: 'Cache-Control',
-						value: 'public, max-age=31536000, immutable',
-					},
-				],
-			},
-		];
-	},
+	// Cache/security headers live in public/_headers (copied into the static
+	// export). next.config headers() is ignored with output: 'export' and only
+	// produces build warnings.
 	images: {
 		unoptimized: true,
 		formats: ['image/avif', 'image/webp'],
diff --git a/web/postcss.config.js b/web/postcss.config.js
index 01bf743..a06f589 100644
--- a/web/postcss.config.js
+++ b/web/postcss.config.js
@@ -1,5 +1,7 @@
-export default {
+const config = {
   plugins: {
     tailwindcss: {},
   },
 };
+
+export default config;
diff --git a/web/prettier.config.js b/web/prettier.config.js
index da332bd..b2d59b4 100644
--- a/web/prettier.config.js
+++ b/web/prettier.config.js
@@ -1,4 +1,6 @@
 /** @type {import('prettier').Config & import('prettier-plugin-tailwindcss').PluginOptions} */
-export default {
+const config = {
   plugins: ["prettier-plugin-tailwindcss"],
 };
+
+export default config;
diff --git a/web/src/components/seo-subpage-shell.tsx b/web/src/components/seo-subpage-shell.tsx
index 485bf41..ed5e1e4 100644
--- a/web/src/components/seo-subpage-shell.tsx
+++ b/web/src/components/seo-subpage-shell.tsx
@@ -296,12 +296,12 @@ export function SeoSubpageShell({ children }: SeoSubpageShellProps) {
 
           <div className="flex items-center gap-2">
             <ThemeToggle />
-            <a
+            <Link
               href="/#install"
               className="hidden h-9 items-center rounded-full bg-primary px-4 text-sm font-medium text-primary-foreground sm:inline-flex"
             >
               Install
-            </a>
+            </Link>
             <button
               type="button"
               onClick={(e) => {
@@ -347,13 +347,13 @@ export function SeoSubpageShell({ children }: SeoSubpageShellProps) {
                   </div>
                 </div>
               ))}
-              <a
+              <Link
                 href="/#install"
                 onClick={() => setMobileMenuOpen(false)}
                 className="mt-2 flex items-center justify-center rounded-full bg-primary px-4 py-2.5 text-sm font-semibold text-primary-foreground"
               >
                 Install Vocalinux
-              </a>
+              </Link>
             </nav>
           </div>
         ) : null}
@@ -384,12 +384,12 @@ export function SeoSubpageShell({ children }: SeoSubpageShellProps) {
                 Home
                 <ChevronRight className="h-4 w-4" />
               </Link>
-              <a
+              <Link
                 href="/#install"
                 className="inline-flex items-center gap-1.5 rounded-full border border-zinc-700 px-4 py-2 text-sm font-medium text-zinc-100 transition-colors hover:border-zinc-500"
               >
                 Install
-              </a>
+              </Link>
               <a
                 href="https://github.com/jatinkrmalik/vocalinux"
                 target="_blank"