diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..4d9548bcc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,46 @@
+# Once a month, one pull request per directory with all minor and patch updates,
+# also of the packages that the listed ones depend on; a new major version gets
+# a pull request of its own. Security updates come as soon as an advisory is
+# published.
+#
+# Not covered, because the files are generated:
+# - the GitHub Actions in .github/workflows/build.yaml; their versions are in
+#   ci/src/GithubJobBuilder.php
+# - the base images in docker/*/*/Dockerfile; the nightly build pulls them anew
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /ci
+    schedule:
+      interval: monthly
+    allow:
+      - dependency-type: all
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: '[TASK]'
+    groups:
+      ci:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: bundler
+    directory: /tests/serverspec
+    schedule:
+      interval: monthly
+    allow:
+      - dependency-type: all
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: '[TASK]'
+    groups:
+      serverspec:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d24df642a..b8fb814ff 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -47,6 +47,9 @@ It installs the PHP tools of `ci/` and runs GrumPHP as your user. `make test` ru
 
 The CI job "Check ci/" runs the same checks. No image build waits for it.
 
+Dependabot proposes updates of the PHP packages in `ci/` and of the gems of the serverspec tests in `tests/serverspec/` once a month: one pull request per directory with all minor and patch updates, and one for each new major version.
+It does not update the actions in `.github/workflows/build.yaml`, because that file is generated; their versions are in `ci/src/GithubJobBuilder.php`.
+
 GitHub Actions builds every image independently and runs the serverspec and structure tests
 defined for it before pushing it to Docker Hub. The CI also uses `ghcr.io/webdevops/`, but only
 internally; pull the images from Docker Hub.