diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 31fb2d0..c6fc0dd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,19 @@
 # Keeps GitHub Actions and Python (uv) dependencies fresh. The github-actions
 # updates also handle version drift on the Actions pinned in CI, so we don't
 # hand-pin them to commit SHAs.
+#
+# target-branch is set on every entry because Dependabot otherwise opens against the
+# default branch (main), while CONTRIBUTING requires PRs to be based on dev. Without
+# it, a merged bump lands on main only and dev's CI keeps testing the old version.
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
   - package-ecosystem: "uv"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
diff --git a/pyproject.toml b/pyproject.toml
index 1b262a5..cfc29f4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -63,3 +63,11 @@ pythonpath = ["src"]
 [tool.ruff]
 line-length = 100
 target-version = "py311"
+
+# Pin the rule set explicitly. Without this, the project inherits whatever Ruff's
+# defaults happen to be, so "lint clean" changes meaning on a Ruff upgrade rather
+# than on a decision here — 0.16.0 widened the defaults and surfaced 84 findings in
+# unchanged code. These four are Ruff's classic defaults and are exactly what CI
+# enforced before the pin. Widening the set is a deliberate, separate change.
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F"]