diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..54b5745
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,58 @@
+# Dependency version updates. Holds are written down here with their reason;
+# remove an ignore rule when its reason no longer applies.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+    # Supply-chain caution: do not adopt a release on the day it is published.
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps(web)
+    groups:
+      web-minor-patch:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # TypeScript 7 has no JS API, svelte-check peers `^5 || ^6`, and the
+      # TypeScript 7 announcement says Svelte projects should stay on 6.
+      # Revisit when svelte-check supports 7 (hold recorded in #140).
+      - dependency-name: typescript
+        versions: [">=7"]
+      # Tracks the Node 22 floor in web/package.json `engines`.
+      - dependency-name: "@types/node"
+        versions: [">=23"]
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps(rust)
+    groups:
+      rust-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci
+    # Dependabot keeps the full-SHA pins and their `# vX.Y.Z` comments.
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index d72b450..f9840d4 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # Cheap repository guards run first so they fail in seconds.
@@ -37,7 +37,7 @@ jobs:
           rustup toolchain install
           rustup show active-toolchain
       - name: Restore cargo cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -45,7 +45,7 @@ jobs:
             target
           key: pr-gate-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }}
       - name: Restore npm cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: pr-gate-npm-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd1bdf4..f1e6818 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
             target: aarch64-unknown-linux-musl
             arch: aarch64
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Tag matches the Cargo version
@@ -215,7 +215,7 @@ jobs:
       # commit (ADR 0026); verify with `gh attestation verify`.
       - name: Attest build provenance
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             dist/consolebook-linux-${{ matrix.arch }}.tar.gz
@@ -235,7 +235,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # The one-line install fetches the installer from the release, not from
@@ -252,7 +252,7 @@ jobs:
           sha256sum install.sh > install.sh.sha256
           gh release upload "$GITHUB_REF_NAME" --clobber install.sh install.sh.sha256
       - name: Attest installer provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             install.sh
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 77719fa..9a3676b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -35,6 +35,11 @@ GitHub enforces the following; the `main` ruleset is the rung-2 guard for
   `uses:` fails before it runs. Secret scanning with push protection and CodeQL
   code scanning are enabled.
 
+Dependencies move to their latest stable release where it makes sense; any
+hold is written down with its reason, as the `.github/dependabot.yml` ignore
+rules are. Dependabot proposes grouped weekly version updates after a 7-day
+cooldown, and security updates as advisories appear.
+
 Use [the evidence-driven workflow](docs/workflow.md) for outcome definition,
 roles and ownership, task graphs, evidence-driven continuation, and authorization.
 The primary issue body owns the live graph; issue comments archive completed