diff --git a/.github/workflows/dependabot-changelog.yml b/.github/workflows/dependabot-changelog.yml
index 55f0c4c..1adfcf6 100644
--- a/.github/workflows/dependabot-changelog.yml
+++ b/.github/workflows/dependabot-changelog.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Get dependency metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52f8def..c56b2cc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `npm run lint` crashed outright under `typescript@7` (a `TypeError` inside `typescript-eslint`'s `typescript-estree`), which had been masking two real `prettier/prettier` formatting errors in `docs-site/src/components/GrammarDropZone.tsx` and `src/cli/rdp-gen.ts`. Now that the `typescript` downgrade lets lint actually run, ran `eslint --fix` to clear both.
 - `CHANGELOG.md` ended up with two separate `### Fixed` subsections under `## [Unreleased]` after two PRs landed back to back, each adding its own — exactly the duplicate-subsection mistake the new linter (above) is meant to catch. Merged them into one.
 
+### Changed
+
+- Bump `dependabot/fetch-metadata` from 2 to 3
+
 ## [0.7.0] - 2026-04-20
 
 ### Added