diff --git a/.claude/commands/drain.md b/.claude/commands/drain.md
index 819e9eb8924..9974274d943 100644
--- a/.claude/commands/drain.md
+++ b/.claude/commands/drain.md
@@ -189,17 +189,43 @@ for PR in $OPEN_PRS; do
 done
 ```
 
-### Fix branch-specific CI failures
+### Phase 3b: Parallel per-PR agents (MANDATORY for remaining failures)
+
+For every still-failing PR after Phase 3, spawn ONE Agent per PR IN PARALLEL using `isolation: "worktree"` and `mode: "bypassPermissions"`. Send all spawn calls in a single message (multiple Agent tool calls in one turn) so they run concurrently.
+
+Each agent's prompt must include:
+1. The PR number, title, head branch
+2. Current failing checks (name + log URL from `gh pr checks $PR`)
+3. Any unresolved bot/human review comments (fetch via `gh api repos/{owner}/{repo}/pulls/$PR/comments --paginate`)
+4. Instructions:
+   - Check out the PR's head branch in the worktree
+   - Rebase onto latest `main`; resolve conflicts preserving PR intent
+   - Run `pnpm --filter=@jovie/web exec tsc --noEmit`, `pnpm biome check apps/web`, and the failing test files locally
+   - Fix root causes (not symptoms); update tests only if they're wrong
+   - Address each unaddressed CodeRabbit / Greptile comment (fix or reply explaining why declined)
+   - Commit with conventional messages, push to the PR head branch
+   - Enable auto-merge via `gh pr merge $PR --auto`
+   - Report DONE / DONE_WITH_CONCERNS / BLOCKED with the specific reason
+
+Sample Agent tool call (repeat per PR, all in one message):
 
-For each PR that still has failures after the rebase:
-1. Check out the branch
-2. Identify the failure (typecheck, lint, test, etc.)
-3. Fix it, commit, and push
-4. Wait for CI to go green, then enable auto-merge
+```
+Agent({
+  subagent_type: "general-purpose",
+  isolation: "worktree",
+  mode: "bypassPermissions",
+  description: "Fix PR #<NUMBER>",
+  prompt: "<self-contained prompt with failures + comments + instructions>"
+})
+```
+
+Do NOT wait for one agent before spawning the next. Do NOT run them sequentially. The point of this phase is fan-out.
+
+After all agents return, re-run Phase 3 auto-merge enablement and report.
 
 ### Close stale or stuck PRs
 
-PRs that can't be fixed automatically:
+PRs that can't be fixed automatically (agent returns BLOCKED):
 - Close with a comment explaining why
 - Label as `needs-human` if human intervention is required
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39b1ed5753b..22fb332af38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -778,7 +778,7 @@ jobs:
     needs: [ci-build-public, ci-path-changes, neon-db]
     # Runs Lighthouse CI against the public-route build artifact on PRs.
     # Blocks PRs when triggered (path-gated to public-route changes).
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.ci-build-public.outputs.has_artifact == 'true' && needs.ci-path-changes.outputs.run_public_lighthouse == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]' && needs.ci-build-public.outputs.has_artifact == 'true' && needs.ci-path-changes.outputs.run_public_lighthouse == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -1031,7 +1031,7 @@ jobs:
   ci-lighthouse-onboarding-pr:
     name: Lighthouse (onboarding PR)
     needs: [ci-fast, ci-path-changes, neon-db]
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.ci-path-changes.outputs.run_onboarding_lighthouse == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]' && needs.ci-path-changes.outputs.run_onboarding_lighthouse == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -1165,7 +1165,7 @@ jobs:
     # so dependent jobs would silently skip on admin-UI-only PRs. This job creates
     # its own ephemeral branch below and does not reuse the shared neon-db branch.
     needs: [ci-fast, ci-path-changes]
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && needs.ci-path-changes.outputs.run_admin_lighthouse == 'true' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]' && needs.ci-path-changes.outputs.run_admin_lighthouse == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps: