diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 16460ece..0bc378d0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,20 +10,3 @@ updates:
       interval: "weekly"
     labels:
       - "dependencies"
-
-  # Keep runtime/frontend dependencies visible to maintainers without
-  # opening dozens of near-identical public dependency PRs.
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    groups:
-      minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-    labels:
-      - "dependencies"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f7a1fbe8..985bcd87 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -169,7 +169,7 @@ jobs:
       - name: "Restore generated radio search index"
         id: search_cache
         if: steps.scope.outputs.prerender == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: public/search/stations.json
           key: ${{ runner.os }}-onair-search-v1-${{ hashFiles('public/radio/**/*.json', 'utils/featured-stations.mjs', 'scripts/build-station-search-index.mjs') }}
@@ -177,7 +177,7 @@ jobs:
       - name: "Restore generated social preview"
         id: social_cache
         if: steps.scope.outputs.prerender == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: public/brand/social-preview.png
           key: ${{ runner.os }}-onair-social-v1-${{ hashFiles('public/brand/social-preview.svg', 'scripts/generate-social-preview.mjs', 'package-lock.json') }}
diff --git a/tests/ci-prerender-scope.test.mjs b/tests/ci-prerender-scope.test.mjs
index ac6e2a5e..e00e07ae 100644
--- a/tests/ci-prerender-scope.test.mjs
+++ b/tests/ci-prerender-scope.test.mjs
@@ -25,7 +25,7 @@ test('post-build audit scripts use fast CI while asset-generating scripts still
 
 test('generated search catalog and social preview are restored only for full CI with content-derived keys', async () => {
   const yaml = await workflow();
-  assert.match(yaml, /uses: actions\/cache@v4/);
+  assert.match(yaml, /uses: actions\/cache@v6/);
   assert.match(yaml, /path: public\/search\/stations\.json/);
   assert.match(yaml, /hashFiles\('public\/radio\/\*\*\/\*\.json', 'utils\/featured-stations\.mjs', 'scripts\/build-station-search-index\.mjs'\)/);
   assert.match(yaml, /path: public\/brand\/social-preview\.png/);