diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a8eb5a7..16513e6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,9 +17,9 @@ updates:
       - java
     # com.regnosys and Rune artifacts are bumped deliberately as part of
     # release coordination, not by a bot.
-    # xtext-dev-bom and guava are kept off minor/major bumps entirely -
-    # only patch updates are allowed through, and standalone rather than
-    # grouped.
+    # xtext-dev-bom, guava, jaxb-runtime and cxf-xjc-plugin are kept off
+    # minor/major bumps entirely - only patch updates are allowed through,
+    # and standalone rather than grouped.
     ignore:
       - dependency-name: com.regnosys*
       - dependency-name: org.finos.rune*
@@ -43,6 +43,30 @@ updates:
       - dependency-name: com.google.inject*
         update-types:
           - version-update:semver-major
+      # jaxb-runtime 3.x/4.x only registers a jakarta.xml.bind.JAXBContextFactory
+      # provider, not javax.xml.bind's - so FpMLSchemeEnumReader and
+      # IsoCurrencySchemeEnumReader, which call javax.xml.bind.JAXBContext.
+      # newInstance() directly, still compile against the untouched
+      # javax.xml.bind:jaxb-api pin but throw JAXBException ("Implementation
+      # of JAXB-API has not been found") at runtime - confirmed by bumping
+      # jaxb-runtime alone and invoking JAXBContext.newInstance() directly.
+      # Neither reader has a test that exercises that path, so a bot bump
+      # here would pass CI and break silently at runtime.
+      - dependency-name: org.glassfish.jaxb*
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      # cxf-xjc-plugin runs unconditionally at generate-sources (not behind
+      # a profile), regenerating src/generated/java on every build. 4.x
+      # emits jakarta.xml.bind-annotated classes, which fail to compile
+      # against the still-javax jaxb-api/jaxb-runtime pinned above -
+      # confirmed by bumping cxf-xjc-plugin alone: `mvn compile` fails with
+      # "package jakarta.xml.bind.annotation does not exist". Bump together
+      # with jaxb-runtime, deliberately, not by a bot.
+      - dependency-name: org.apache.cxf:cxf-xjc-plugin
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
     # One PR for routine minor/patch drift; majors still come through
     # individually so they get read properly.
     groups:
@@ -50,6 +74,8 @@ updates:
         exclude-patterns:
           - org.eclipse.xtext:xtext-dev-bom
           - com.google.guava:guava
+          - org.glassfish.jaxb*
+          - org.apache.cxf:cxf-xjc-plugin
         update-types:
           - minor
           - patch