diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 364ee67..96f627f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -165,9 +165,10 @@ jobs:
       # its docs Gemfile. `dash deploy` (not `bundle exec dash`) then works for
       # every site regardless of its bundle.
       - name: Install dash
-        # Pinned to the 4.x line: the deploy.yml this workflow deploys sets
-        # `minimum_version: 4.0.0` (dash-proxy identity + host migration).
-        run: gem install dash -v "~> 4.0"
+        # Floor at 4.0.7: the deploy.yml this workflow deploys sets
+        # `minimum_version: 4.0.7` (doctor stale-proxy recovery + registry
+        # credential fail-fast, on top of the 4.0 dash-proxy identity).
+        run: gem install dash -v "~> 4.0.7"
 
       - name: Setup SSH agent
         uses: webfactory/ssh-agent@v0.9.1
diff --git a/README.md b/README.md
index aa56f2e..e31341e 100644
--- a/README.md
+++ b/README.md
@@ -934,7 +934,7 @@ jobs:
 ```yaml
 service: <repo>
 image: zoolutions/<repo>
-minimum_version: 4.0.0        # dash 4: dash-proxy identity + in-place host migration
+minimum_version: 4.0.7        # dash 4.0.7: doctor stale-proxy recovery + registry credential fail-fast
 retain_containers: 2
 error_pages_path: public      # 502/503/504.html served during a deploy gap
 registry: { server: ghcr.io, username: mhenrixon, password: [DASH_REGISTRY_PASSWORD] }
diff --git a/docs/app/views/docs/pages/deploy.rb b/docs/app/views/docs/pages/deploy.rb
index fa8b758..9426b2f 100644
--- a/docs/app/views/docs/pages/deploy.rb
+++ b/docs/app/views/docs/pages/deploy.rb
@@ -78,7 +78,7 @@ def content
                 plain "Every site deploys with "
                 a(href: "https://github.com/zoolutions/dash") { "dash" }
                 plain " 4 ("
-                code { "minimum_version: 4.0.0" }
+                code { "minimum_version: 4.0.7" }
                 plain ") and turns on the per-app dash-proxy features a docs site benefits from — no per-site tuning, the template writes them:"
               end
               ul do
diff --git a/docs/config/deploy.yml b/docs/config/deploy.yml
index 1314bcd..2e12781 100644
--- a/docs/config/deploy.yml
+++ b/docs/config/deploy.yml
@@ -7,7 +7,7 @@ image: zoolutions/docs-kit
 
 # dash 4 renamed the on-host proxy (kamal-proxy → dash-proxy) and migrates a
 # host in place; an older CLI must not deploy this config.
-minimum_version: 4.0.0
+minimum_version: 4.0.7
 
 # A stateless docs site never rolls back far — keep the host tidy.
 retain_containers: 2
diff --git a/lib/docs_kit/templates/new_site.rb b/lib/docs_kit/templates/new_site.rb
index 87b6dbe..35980bd 100644
--- a/lib/docs_kit/templates/new_site.rb
+++ b/lib/docs_kit/templates/new_site.rb
@@ -64,7 +64,7 @@
 
     # dash 4 renamed the on-host proxy (kamal-proxy → dash-proxy) and migrates a
     # host in place; an older CLI must not deploy this config.
-    minimum_version: 4.0.0
+    minimum_version: 4.0.7
 
     # A stateless docs site never rolls back far — keep the host tidy.
     retain_containers: 2