diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ab48c93..8ae018f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,29 +1,33 @@
 # SPDX-FileCopyrightText: Sudo Apt Holdings LLC
 # SPDX-License-Identifier: Apache-2.0
 #
-# Dependabot opens a pull request when a dependency has a security advisory or a newer
-# release. A pull request is not an upgrade: VERSIONS.md is the pin list, and a version
-# lands only after it is proposed in a slice's NOTES.md and approved (CLAUDE.md section 5).
-# The value here is the alert arriving as a diff with the gate run against it.
+# Dependabot opens a pull request only when a dependency has a security advisory. Version
+# bumps are not raised: VERSIONS.md is the pin list, and a version lands only after it is
+# proposed in a slice's NOTES.md and approved (CLAUDE.md section 5). On its first run, with
+# the limit above zero, it opened five version-bump pull requests inside two minutes; one of
+# them was merged by mistake. An open-pull-requests-limit of 0 keeps the security updates and
+# drops the rest. The value here is a security alert arriving as a diff with the gate run
+# against it.
 version: 2
 updates:
   - package-ecosystem: mix
     directory: /
     schedule:
       interval: weekly
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "chore(deps)"
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "chore(ci)"
   - package-ecosystem: cargo
     directory: /src-tauri
     schedule:
       interval: weekly
-    open-pull-requests-limit: 3
+    open-pull-requests-limit: 0
     commit-message:
       prefix: "chore(deps)"
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index f8276cf..f52c02a 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -170,7 +170,7 @@ jobs:
       # --no-halt is what makes the exit mean anything. Burrito launches the release as
       # `-s elixir start_cli`, and the Elixir CLI halts when its command list is empty, so
       # without --no-halt the binary exits 0 on its own and `--smoke` proves nothing.
-      - name: Smoke test: boots, serves, exits by itself, leaves nothing behind
+      - name: "Smoke test: boots, serves, exits by itself, leaves nothing behind"
         if: runner.os != 'Windows'
         shell: bash
         run: |