diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a5a067646..4ac035cc4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -38,6 +38,16 @@ updates:
       cargo-security:
         applies-to: security-updates
         patterns: ["*"]
+      # The one exception to "majors are not grouped". piet-coregraphics pins
+      # an exact piet, so a piet major arriving alone cannot compile: every
+      # RenderContext method disappears from CoreGraphicsContext at once and
+      # the macOS build fails with a dozen E0599s that say nothing about the
+      # real cause. The two are one decision, so they are one pull request.
+      piet:
+        applies-to: version-updates
+        patterns:
+          - "piet"
+          - "piet-coregraphics"
     # A version published minutes ago has been reviewed by nobody. The cooldown
     # is the cheapest defence against a compromised release being pulled in
     # before anyone has looked at it, and costs only a few days of latency on
diff --git a/Cargo.toml b/Cargo.toml
index 0a901b34d..58a4c454c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -159,7 +159,12 @@ core-graphics = "0.22"
 include_dir = "0.7"
 fruitbasket = "0.10"
 objc_id = "0.1"
-# If we use piet "0.7" here, we must also update core-graphics to "0.24".
+# piet and piet-coregraphics move together: piet-coregraphics pins an exact
+# piet, and taking one alone removes every RenderContext method from
+# CoreGraphicsContext. Past 0.6 the pair also requires core-graphics "0.24",
+# which cocoa 0.24 does not take, so the next bump is a coordinated macOS
+# stack upgrade rather than a dependency bump. A Dependabot group keeps the
+# pair in one pull request so that decision arrives whole.
 piet = "0.6"
 piet-coregraphics = "0.6"
 foreign-types = "0.3"