diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b7ec34f..da2caf6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,11 @@ updates:
     groups:
       npm-minor-patch:
         update-types: [minor, patch]
+    # Major upgrades are done on purpose in their own PR, not by the bot.
+    # Dependabot alerts still report vulnerable versions.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /