diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8555bf5..b0d879d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,11 +18,32 @@ updates:
       prefix-development: "deps-dev"
       include: "scope"
     groups:
-      # All dev/CI tooling (eslint, vitest, typescript, @types/*, etc.) incl.
-      # majors → ONE PR. The janitor auto-merges it when CI is green.
+      # All dev/CI tooling (eslint, typescript, @types/*, etc.) incl. majors ->
+      # ONE PR. The janitor auto-merges it when CI is green.
+      # msw + vitest EXCLUDED here (2026-10-13, task_1791494841949) -- a
+      # grouped msw+vitest MAJOR bump (e.g. msw 2.x->3.x + vitest 4.x->5.x)
+      # produces an internally-inconsistent lockfile that Dependabot's own
+      # version-resolution doesn't catch (npm ci EUSAGE; a newer local npm
+      # silently auto-heals the gap, so a casual local check false-passes --
+      # only reproduces against CI's exact npm version). Confirmed across 8
+      # repos in burn-down round 2. Their MAJORS now fall through ungrouped
+      # -> individual PRs, held for human review, same as production majors
+      # below. Minor/patch bumps are unaffected -- see the group below.
       dev-dependencies:
         dependency-type: "development"
         update-types: ["major", "minor", "patch"]
+        exclude-patterns:
+          - "msw"
+          - "vitest"
+          - "@vitest/*"
+      # msw/vitest minor+patch stay grouped+auto-merged like any other dev dep.
+      dev-dependencies-msw-vitest-minor-patch:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
+        patterns:
+          - "msw"
+          - "vitest"
+          - "@vitest/*"
       # Production minor + patch → ONE PR. Auto-merged when green.
       production-minor-patch:
         dependency-type: "production"