diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..5981dfef
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,49 @@
+version: 2
+updates:
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      # Minor/patch bumps land together; a major stays its own PR so a snapshot-risk bump like
+      # #221 is attributable to one dependency, not buried in a batch. The one shipped runtime
+      # dependency is excluded even from this group: its patches change emitted CMS/PAdES bytes,
+      # so it does not belong next to routine test-tooling churn.
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        exclude-patterns:
+          - "System.Security.Cryptography.Pkcs"
+    ignore:
+      # #200 holds the xunit.v3 family and xunit.runner.visualstudio on 3.x deliberately until
+      # the Microsoft.Testing.Platform migration lands; a weekly major bump proposal here would
+      # target a known-red build. "xunit.v3*" matches both xunit.v3 and xunit.v3.assert.
+      - dependency-name: "xunit.v3*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "xunit.runner.visualstudio"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    # No group: every action here is currently pinned to a floating major tag (e.g.
+    # actions/checkout@v7), so only major bumps ever surface. A group block would read as doing
+    # something it cannot.
+
+  - package-ecosystem: "dotnet-sdk"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    # This updater parses global.json but does not act on rollForward, so it proposes SDKs
+    # outside the pinned 10.0.4xx feature band (a later 10.0.5xx, eventually 11.x) as readily as
+    # ones inside it. That is intended, not a bug in this config: #379 pins the band deliberately
+    # and its CONTRIBUTING rule requires a human to merge a band move on purpose and CI-validate
+    # it before the next tag, so each such PR is that signal, not noise to dismiss.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acecf674..c8d1dd73 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -215,6 +215,11 @@ jobs:
         env:
           REQUIRE_VERAPDF: '1'
           REQUIRE_BARCODE_ORACLE: '1'
+          # DiffEngine 20.0.0 reads its disable flag lazily instead of capturing it once at
+          # type-init (VerifyTests/DiffEngine#825) and now installs a bundled viewer as an
+          # always-available last-resort tool, so a detection miss that was a harmless no-op in
+          # 19.x could launch a GUI here instead. Setting this explicitly closes that gap.
+          DiffEngine_Disabled: 'true'
         run: dotnet test VellumPdf.slnx -c Release --no-build --collect:"XPlat Code Coverage" --results-directory ${{ runner.temp }}/coverage
 
       - name: Enforce coverage threshold
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90e06f08..0c6c86f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -248,6 +248,35 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `latestPatch`, and all five `setup-dotnet` steps (`ci.yml` build and AOT smoke jobs, `release.yml`
   library and tool jobs, `docs.yml`) point at `global-json-file: global.json` rather than repeating
   the version inline, so the two can no longer drift apart. (#231)
+- **`Verify.XunitV3` moves to 32.0.0.** The dependency floor on `xunit.v3.extensibility.core` is
+  `[3.2.2, )`, open-ended and already satisfied by the xunit.v3 3.2.2 pin in
+  `Directory.Packages.props`, from which `extensibility.core` comes transitively, so the bump is
+  independent of #200's xunit v4 migration. The measured transitive delta against the base
+  commit's restore: `Verify` 31.28.0 → 32.0.0, moving in lockstep with `Verify.XunitV3` itself,
+  `DiffEngine` 19.3.3 → 20.0.0 (a major), and `Microsoft.Bcl.AsyncInterfaces` 10.0.10 → 10.0.11;
+  `Argon` and `SimpleInfoName` were already in 31.28.0's closure and did not move. DiffEngine
+  20.0.0 reads its own disable flag lazily rather than capturing it once at type-init
+  (VerifyTests/DiffEngine#825) and adds a bundled viewer as an always-available last-resort tool,
+  so a detection miss that was a harmless no-op in 19.x could now launch a GUI. `ci.yml`'s test
+  step sets `DiffEngine_Disabled: true` against that, and `tests/Directory.Build.props` sets
+  `<DiffEngineBundledViewer>false</DiffEngineBundledViewer>`, which drops the bundled viewer
+  binaries and the `DiffEngine.ViewerDirectory` path DiffEngine's build targets otherwise stamp
+  into each test project's `runtimeconfig.json` — a username-bearing absolute path this keeps out
+  of build artifacts. Neither setting reaches a developer's own installed diff tool (VS, Rider, VS
+  Code, WinMerge); only `DiffEngine_Disabled` does that. None of the five packages above appear in
+  `dotnet list package --vulnerable`. No `.verified.*` file under `tests/` changed. (#221)
+- Added `.github/dependabot.yml`: weekly `nuget`, `github-actions`, and `dotnet-sdk` checks. The
+  `nuget` group batches minor/patch bumps into one PR and excludes
+  `System.Security.Cryptography.Pkcs` — the one third-party runtime dependency this repository
+  ships, whose patches change emitted CMS/PAdES bytes — from that batch; majors stay individual, so
+  a snapshot-risk major like this one stays attributable to a single PR. `xunit.v3*` (matching
+  `xunit.v3` and `xunit.v3.assert`) and `xunit.runner.visualstudio` majors are ignored pending
+  #200's deliberate hold on the v3-to-v4 migration. `dotnet-sdk` covers the `global.json`
+  feature-band pin from #379: that updater does not read `rollForward`, so it proposes SDKs
+  outside the pinned 10.0.4xx band as readily as ones inside it — by design, since each such PR is
+  the deliberate band-move signal #379's CONTRIBUTING rule calls for, not noise. `github-actions`
+  carries no group: every action here is currently pinned to a floating major tag, so only major
+  bumps ever surface. (#221)
 
 ### Fixed
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 8589a9be..15901d8d 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -25,7 +25,7 @@
          test host (OutputType=Exe), which a shared helper library is not. -->
     <PackageVersion Include="xunit.v3.assert" Version="3.2.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
-    <PackageVersion Include="Verify.XunitV3" Version="31.28.0" />
+    <PackageVersion Include="Verify.XunitV3" Version="32.0.0" />
     <PackageVersion Include="CsCheck" Version="4.8.0" />
     <PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
diff --git a/tests/Directory.Build.props b/tests/Directory.Build.props
index c9a2c709..7f2d8454 100644
--- a/tests/Directory.Build.props
+++ b/tests/Directory.Build.props
@@ -7,6 +7,13 @@
     <IsTestProject>true</IsTestProject>
     <!-- xUnit v3 test projects produce a self-hosting executable. -->
     <OutputType>Exe</OutputType>
+    <!-- DiffEngine 20.0.0 bundles its own native viewer as a last-resort tool by default. This
+         only drops that bundled binary and the DiffEngine.ViewerDirectory path its build targets
+         otherwise stamp into runtimeconfig.json (a stamp that also carries a username-bearing
+         absolute path, so this keeps build artifacts free of it) — a developer with VS, Rider,
+         VS Code, or WinMerge installed still gets a GUI on a snapshot failure. DiffEngine_Disabled
+         is the setting that suppresses that too. -->
+    <DiffEngineBundledViewer>false</DiffEngineBundledViewer>
   </PropertyGroup>
 
   <ItemGroup>