diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 13fcccb3a..26bbbb041 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,10 @@ updates:
     schedule:
       interval: monthly
       time: "00:00"
+    # Keep version updates beyond pnpm's 24-hour release-age guard.
+    # Security updates bypass cooldown; transitive resolution also needs the workspace gate.
+    cooldown:
+      default-days: 3
     open-pull-requests-limit: 10
     reviewers:
       - AchoArnold
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index 391a8baf8..816d7767e 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -5,3 +5,5 @@ allowBuilds:
   protobufjs: true
   unrs-resolver: true
   vue-demi: true
+# Share pnpm's 24-hour guard with Dependabot's resolver, including pnpm 10.16+.
+minimumReleaseAge: 1440