diff --git a/bun.lock b/bun.lock
index ab7ac50..6419ada 100644
--- a/bun.lock
+++ b/bun.lock
@@ -5,7 +5,7 @@
     "": {
       "name": "crew",
       "dependencies": {
-        "js-yaml": "^4.1.1",
+        "js-yaml": "^5.2.0",
         "proper-lockfile": "^4.1.2",
         "yargs": "^18.0.0",
       },
@@ -72,7 +72,7 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
+    "js-yaml": ["js-yaml@5.2.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.mjs" } }, "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw=="],
 
     "proper-lockfile": ["proper-lockfile@4.1.2", "", { "dependencies": { "graceful-fs": "^4.2.4", "retry": "^0.12.0", "signal-exit": "^3.0.2" } }, "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA=="],
 
diff --git a/package.json b/package.json
index 20621fc..2aa8d07 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.2.0",
     "proper-lockfile": "^4.1.2",
     "yargs": "^18.0.0"
   }
diff --git a/src/yaml/parse.ts b/src/yaml/parse.ts
index ccd8a18..9ff3fd2 100644
--- a/src/yaml/parse.ts
+++ b/src/yaml/parse.ts
@@ -11,7 +11,7 @@
  *   - one import site to update if we ever want to swap the library.
  */
 
-import { dump, load } from "js-yaml";
+import { dump, load, YAMLException } from "js-yaml";
 
 /** The value kinds we accept. */
 export type YamlValue = string | number | boolean | null | YamlValue[] | YamlMap;
@@ -20,14 +20,19 @@ export type YamlMap = { [key: string]: YamlValue };
 /** Parse a YAML document. Throws on malformed input. */
 export function parseYaml(source: string): YamlValue {
   // `load` already rejects multi-document input (use `loadAll` for that) and
-  // in js-yaml v4 it uses the DEFAULT_SCHEMA which is safe (no !!js/function,
+  // uses the DEFAULT_SCHEMA, which is safe (no !!js/function,
   // no !!js/regexp, no !!js/undefined).
-  const value = load(source);
-  // js-yaml returns `undefined` for an empty document; we normalize to `null`
-  // so callers never have to branch between the two (YAML itself treats them
-  // the same — `~`, `null`, and an empty document all mean "no value").
-  if (value === undefined) {
-    return null;
+  let value: unknown;
+  try {
+    value = load(source);
+  } catch (err) {
+    if (
+      err instanceof YAMLException &&
+      err.reason === "expected a document, but the input is empty"
+    ) {
+      return null;
+    }
+    throw err;
   }
   return value as YamlValue;
 }