diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index 08415f2..fc73816 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -16,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out etherpad-load-test
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: ./loadtest
 
       - name: Check out Etherpad core
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
           path: ./etherpad
@@ -78,6 +78,15 @@ jobs:
           # The previous step (runnerLoadTest.sh) tore Etherpad down, so
           # bring a minimal one back up just for the sweep integration test.
           cd ./etherpad
+          # The sweep drives 2..4 authors from a single IP (127.0.0.1). Core's
+          # default commitRateLimiting is 10 changes/s/IP, so the 4-author step
+          # (~20 changes/s) trips the limiter; a rate-limited USER_CHANGES never
+          # gets an ACCEPT_COMMIT, which stalls the cli-client's in-flight slot
+          # and zeroes out that step's latency samples. Raise the cap for the
+          # SUT so we measure throughput, not the rate limiter (mirrors the
+          # importExportRateLimiting bump runnerLoadTest.sh already applies).
+          sed -e '/^ *"commitRateLimiting":/,/^ *\}/ s!"points":[^,]*!"points": 1000000!' -i settings.json
+          grep -q '"points": 1000000' settings.json  # fail fast if the limiter wasn't raised
           (cd src && pnpm run prod &)
           for i in $(seq 1 60); do
             curl -sf http://127.0.0.1:9001/ >/dev/null && break
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b59e78c..808edac 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
diff --git a/.github/workflows/cpu-profile.yml b/.github/workflows/cpu-profile.yml
index d20a7c5..4e6161c 100644
--- a/.github/workflows/cpu-profile.yml
+++ b/.github/workflows/cpu-profile.yml
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Checkout etherpad-load-test
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: ./loadtest
 
       - name: Checkout etherpad core (${{ inputs.core_ref }})
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad
           ref: ${{ inputs.core_ref }}
diff --git a/.github/workflows/npmpublish.yml b/.github/workflows/npmpublish.yml
index e5dd1b7..f882589 100644
--- a/.github/workflows/npmpublish.yml
+++ b/.github/workflows/npmpublish.yml
@@ -17,7 +17,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:
@@ -56,7 +56,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scaling-dive.yml b/.github/workflows/scaling-dive.yml
index 317174a..d4f6236 100644
--- a/.github/workflows/scaling-dive.yml
+++ b/.github/workflows/scaling-dive.yml
@@ -41,12 +41,12 @@ jobs:
 
     steps:
       - name: Checkout etherpad-load-test
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: ./loadtest
 
       - name: Checkout etherpad core (${{ inputs.core_ref }})
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad
           ref: ${{ inputs.core_ref }}
diff --git a/package.json b/package.json
index 63b9f24..73c9d46 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   },
   "contributors": [],
   "dependencies": {
-    "etherpad-cli-client": "^4.0.2",
+    "etherpad-cli-client": "^4.0.3",
     "hdr-histogram-js": "^3.0.1"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a335e79..067405e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       etherpad-cli-client:
-        specifier: ^4.0.2
-        version: 4.0.2
+        specifier: ^4.0.3
+        version: 4.0.3
       hdr-histogram-js:
         specifier: ^3.0.1
         version: 3.0.1
@@ -619,8 +619,8 @@ packages:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
-  etherpad-cli-client@4.0.2:
-    resolution: {integrity: sha512-oAyJxJj4UH0AAEmMPpMiTHKd2IT14OWnKaPzWTqLh3BJ8nyEv/IAMA5scAGjet0xKNERm+k7VSnfeJQvN4adKQ==}
+  etherpad-cli-client@4.0.3:
+    resolution: {integrity: sha512-nQt5FxpmfQHwJ546TJXKMT4fMIS1crvU+NvHAypfboHTsbFQMIPOu4ZANSirRzE1lYnH4APUBDwMQqlKeQt9rw==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -1562,7 +1562,7 @@ snapshots:
 
   esutils@2.0.3: {}
 
-  etherpad-cli-client@4.0.2:
+  etherpad-cli-client@4.0.3:
     dependencies:
       socket.io-client: 4.8.3
       superagent: 10.3.0