diff --git a/.github/workflows/train.yml b/.github/workflows/train.yml
index 84282ec..d3fcc38 100644
--- a/.github/workflows/train.yml
+++ b/.github/workflows/train.yml
@@ -89,7 +89,8 @@ jobs:
           set -euo pipefail
           # L2 upgrade: pull in memory-core + server-memory versions released
           # earlier tonight. A dep change alone justifies the weekly release.
-          npx --yes npm-check-updates -u --dep prod,dev --filter "@agentage/*"
+          # --target minor: majors stay a deliberate human/dependabot call, not an auto-bump.
+          npx --yes npm-check-updates -u --target minor --dep prod,dev --filter "@agentage/*"
           npm install
           if git diff --quiet -- package.json package-lock.json; then
             echo "No @agentage/* dependency changes."