diff --git a/.github/AGENTS.md b/.github/AGENTS.md
index 0aaf8baf..9babd9c4 100644
--- a/.github/AGENTS.md
+++ b/.github/AGENTS.md
@@ -17,6 +17,7 @@
   prefill for binaries that can never be updated retroactively.
 - Keep Linux system dependencies aligned with real build needs for Wayland, Cairo, Pango, GTK4/libadwaita, D-Bus, packaging, and Nix checks.
 - `deny.toml` is the dependency policy and the `dependency-policy` job enforces it. Advisories report without blocking, so a new advisory cannot fail an unrelated pull request; bans, licenses, and sources block.
+- `dependabot.yml` proposes weekly Cargo and GitHub Actions updates. Its zbus major-version ignore is coupled to the advisory ignores in `deny.toml`.
 - Do not weaken release checks or skip package layout/version validation without a documented reason.
 
 ## Coupled Changes
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..08ed61af
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      compatible:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # ksni, which the tray feature needs, still requires zbus 5. Remove this
+      # with the matching advisory ignores in deny.toml.
+      - dependency-name: zbus
+        update-types:
+          - version-update:semver-major
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"