diff --git a/.claude/skills/update-deps/SKILL.md b/.claude/skills/update-deps/SKILL.md
index f0fba65..a0d7a4c 100644
--- a/.claude/skills/update-deps/SKILL.md
+++ b/.claude/skills/update-deps/SKILL.md
@@ -17,7 +17,7 @@ allowed-tools:
   - Bash(git diff *)
   - Bash(gh pr list *)
   - Bash(gh pr diff *)
-  - Bash(gh api repos/mozilla/protocol/dependabot/alerts*)
+  - Bash(gh api repos/mozilla/ensemble/dependabot/alerts*)
   - Read
   - Edit
   - Grep
@@ -92,7 +92,7 @@ Run these for every outdated dependency, including patch bumps. An update to one
 
 ### Security status
 
-Fetch open alerts with `gh api "repos/mozilla/protocol/dependabot/alerts?state=open&per_page=100"`. An update is **security-related** if it moves the package out of an alert's vulnerable range. Record the highest severity it fixes.
+Fetch open alerts with `gh api "repos/mozilla/ensemble/dependabot/alerts?state=open&per_page=100"`. An update is **security-related** if it moves the package out of an alert's vulnerable range. Record the highest severity it fixes. If the request fails, stop and tell the user the security check is incomplete; don't treat a failure as "no alerts."
 
 ### 7-day cool-down
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..802af1e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,55 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "npm"
+    directory: "/"
+    ignore:
+      # Enzyme only supports React 16 (enzyme-adapter-react-16), so React majors break the unit tests.
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-test-renderer"
+        update-types: ["version-update:semver-major"]
+      # 3.x is a rewrite that's incompatible with react-metrics-graphics (see update-deps/denied.md).
+      - dependency-name: "metrics-graphics"
+        update-types: ["version-update:semver-major"]
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+    open-pull-requests-limit: 10
+    groups:
+      frontend:
+        dependency-type: production
+        update-types:
+          - "minor"
+          - "patch"
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - "minor"
+          - "patch"
+      # Security updates ignore the groups above (they default to version-updates).
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - dependencies