diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 36d8ea4..8597d7d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,10 @@
 version: 2
+
+# Dependabot reads this file from the DEFAULT branch (main), not from target-branch, so
+# edits take effect only once they are released to main.
+#
+# Updates are grouped (one PR per group per week, not one per dependency), and the commit
+# prefix is pinned so Dependabot doesn't guess a type/scope from repo history.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -8,6 +14,11 @@ updates:
     labels:
       - "dependencies"
       - "ci"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github-actions:
+        patterns: ["*"]
 
   # "uv" (not "pip") so updates also refresh uv.lock
   - package-ecosystem: "uv"
@@ -18,3 +29,13 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      # ruff and ty bumps routinely bring new lint/type diagnostics that need code fixes;
+      # keep them apart so they can't hold up the routine bumps. A dependency joins the
+      # FIRST group it matches, so this must stay above the catch-all.
+      astral-tools:
+        patterns: ["ruff", "ty"]
+      python:
+        patterns: ["*"]
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 82f7531..b3fead6 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -41,6 +41,17 @@ jobs:
           # non-conventional squash) commits — those are already on main and are
           # not this PR's responsibility to police.
           commits="$(git rev-list --no-merges --reverse "${base}..${head}" --not FETCH_HEAD)"
+          # Dependabot copies its subject casing from repo history rather than from
+          # dependabot.yml, so its "chore(deps): Bump ..." can fail subject-case. Its own
+          # commits are machine-generated and never reach the changelog, so skip them —
+          # but only on PRs Dependabot opened, so a forged author elsewhere is still
+          # linted, and any human commit pushed onto a Dependabot PR still is too.
+          if [ "${{ github.event.pull_request.user.login }}" = "dependabot[bot]" ]; then
+            bot="49699333+dependabot[bot]@users.noreply.github.com"
+            commits="$(git rev-list --no-merges --reverse --no-commit-header --format='%H %ae' \
+              "${base}..${head}" --not FETCH_HEAD | awk -v bot="${bot}" '$2 != bot { print $1 }')"
+            echo "Dependabot PR: skipping commits authored by ${bot}."
+          fi
           if [ -z "${commits}" ]; then
             echo "No PR-unique commits to lint (mergeback/back-merge or merge-only PR)."
             exit 0