diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2077fec
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,34 @@
+# Dependency alerting for selenium-boot.
+#
+# pom.xml pins every dependency to an exact version, so Dependabot always has
+# something to compare against — unlike selenium-mcp's pip pin, no upper
+# bound is needed here for it to see updates.
+#
+# Not auto-merged: a bumped PR still has to clear `mvn test` (480 unit tests)
+# before it's mergeable, same bar as any other change to this repo.
+version: 2
+updates:
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "deps"
+
+  # Workflows pin actions by major tag; this catches the ones that go stale.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "ci"