diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3bf8ad5..88b4fe9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,6 +10,11 @@ updates:
       tooling:
         patterns: ["*"]
         exclude-patterns: ["@missing-elements/*"]
+    # New versions wait three days, but ours are taken the day they are released: they are what
+    # these pages run. pnpm-workspace.yaml leaves them out of pnpm's age check to match (#9).
+    cooldown:
+      default-days: 3
+      exclude: ["@missing-elements/*"]
   - package-ecosystem: github-actions
     directory: /
     schedule:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..7061135
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,7 @@
+# pnpm settings for this site, which is one package, not a workspace.
+#
+# Dependabot holds every new version back three days and runs pnpm with that minimum release age,
+# which then refuses any locked version younger than it. The site pins @missing-elements releases
+# on the day they come out, so they are left out of the age; every other package keeps it (#9).
+minimumReleaseAgeExclude:
+  - "@missing-elements/*"