diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index adae3ee..4e318b5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,9 +4,13 @@ updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "weekly"
-      day: "monday"
+      interval: "monthly"
       time: "09:00"
+    # Wait before proposing a new release, so a compromised or quickly
+    # superseded publish is less likely to reach this repository.
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
@@ -20,23 +24,34 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "zod"
         update-types: ["version-update:semver-major"]
-    # Group all patch updates together
+    # One PR for runtime dependencies (bundled into the extension) and one
+    # for dev dependencies. Major updates still open their own PRs.
     groups:
-      patch-updates:
-        patterns:
-          - "*"
+      runtime:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      dev:
+        dependency-type: "development"
         update-types:
+          - "minor"
           - "patch"
 
   # Enable version updates for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-      day: "monday"
+      interval: "monthly"
       time: "09:00"
+    cooldown:
+      default-days: 7
     labels:
       - "dependencies"
       - "github-actions"
     commit-message:
       prefix: "chore(ci):"
+    groups:
+      actions:
+        patterns:
+          - "*"