diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bd13c5a2..d59ed044 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,6 +24,9 @@ updates:
       # Keep Node types aligned with the production Node 24.x runtime (PR #269).
       - dependency-name: "@types/node"
         versions: [">=25"]
+      # typescript-eslint does not support TypeScript 7 yet; CI fails with that error (PR #288).
+      - dependency-name: typescript
+        versions: [">=7"]
     groups:
       # Group minor + patch updates so we don't get a flood of PRs
       minor-and-patch:
diff --git a/scripts/ci-workflow.test.mjs b/scripts/ci-workflow.test.mjs
index abc79f12..1496d3fa 100644
--- a/scripts/ci-workflow.test.mjs
+++ b/scripts/ci-workflow.test.mjs
@@ -28,6 +28,7 @@ const ignore = npmUpdates.split(/^    ignore:$/m)[1]?.split(/^    [\w-]+:/m)[0]
 assert.ok(ignore, 'Dependabot npm updates must have an ignore block')
 assert.match(ignore, /^      - dependency-name: eslint\n        versions: \[">=10"\]$/m)
 assert.match(ignore, /^      - dependency-name: "@types\/node"\n        versions: \[">=25"\]$/m)
+assert.match(ignore, /^      - dependency-name: typescript\n        versions: \[">=7"\]$/m)
 
 // The guard decides whether the Supabase-backed steps can run at all.
 const guard = step('Resolve Supabase build credentials')