diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..08ab0877
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,111 @@
+version: 2
+
+updates:
+  # NuGet — every project sits one level down under src/Cove.<Name>/ (each folder holds one
+  # .csproj). Targeting the project directories directly means discovery never depends on the
+  # solution file being parsed, and new projects added under src/ are covered automatically.
+  - package-ecosystem: "nuget"
+    directories:
+      - "/src/*"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      entity-framework:
+        patterns:
+          - "Microsoft.EntityFrameworkCore*"
+          - "Npgsql*"
+          - "Pgvector*"
+      test:
+        patterns:
+          - "xunit*"
+          - "Xunit.*"
+          - "Microsoft.NET.Test.Sdk"
+          - "coverlet.*"
+          - "Microsoft.AspNetCore.Mvc.Testing"
+      serilog:
+        patterns:
+          - "Serilog*"
+      nuget-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # npm — two standalone packages, each with its own lockfile: the SPA (ui/) and the published
+  # extension frontend SDK (sdk/frontend/). They are not npm workspaces, so each directory is
+  # listed explicitly.
+  - package-ecosystem: "npm"
+    directories:
+      - "/ui"
+      - "/sdk/frontend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+      tanstack:
+        patterns:
+          - "@tanstack/*"
+      npm-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions — all workflow action versions under .github/workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      actions-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Docker — both base images live under docker/ (Dockerfile and Dockerfile.app); the docker
+  # updater matches any file whose name contains "dockerfile", so one directory entry covers both.
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      docker-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Docker Compose — the deployment stacks under docker/ pin external images (e.g. the
+  # pgvector database); Compose is a separate ecosystem from the Dockerfile updater above.
+  - package-ecosystem: "docker-compose"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 5
+    groups:
+      docker-compose-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/src/Cove.PerformanceTests/Cove.PerformanceTests.csproj b/src/Cove.PerformanceTests/Cove.PerformanceTests.csproj
index 6a44e62e..f10ecd82 100644
--- a/src/Cove.PerformanceTests/Cove.PerformanceTests.csproj
+++ b/src/Cove.PerformanceTests/Cove.PerformanceTests.csproj
@@ -8,11 +8,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
     <PackageReference Include="Npgsql" Version="10.0.2" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Cove.Tests/Cove.Tests.csproj b/src/Cove.Tests/Cove.Tests.csproj
index 4cd912c2..f8215074 100644
--- a/src/Cove.Tests/Cove.Tests.csproj
+++ b/src/Cove.Tests/Cove.Tests.csproj
@@ -8,14 +8,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.6" />
+    <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.6" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.6" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.6" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>