diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 4271a67..87e94d5 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -22,7 +22,12 @@ permissions:
 
 jobs:
   auto-merge:
-    if: github.actor == 'dependabot[bot]'
+    # Who opened the pull request, not who triggered the event. `github.actor`
+    # is whoever caused this run, so the moment a person touches a Dependabot
+    # pull request - reopening it, or nudging it after a base change - the job
+    # skips and the update sits there looking merged-ready and never merging.
+    # The author never changes, which is the thing actually being asserted.
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -32,7 +37,7 @@ jobs:
       # from the branch is checked out or executed, which is what makes
       # pull_request_target safe to use here.
       - id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@v2
 
       - id: verdict
         name: Decide whether this one can merge itself