diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0a70fc4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,32 @@
+# Dependabot only reads this file from the default branch (1.x). The second entry covers 2.x through target-branch.
+#
+# Only facebook/php-business-sdk is watched. The Graph API version the client talks to is ApiConfig::APIVersion from that
+# package, and Meta ships a new major of it for every Graph API version, a few times a year. Without a PR that widens the
+# constraint, users of this library stay capped at the previous Graph API version.
+#
+# No composer.lock is committed, so a PR is only opened when a release falls outside the allowed range, i.e. for a new
+# major. The other dependencies are left out on purpose: their ranges already float, and the dev tools are held on the
+# majors that still support PHP 8.1.
+version: 2
+
+updates:
+    -   package-ecosystem: "composer"
+        directory: "/"
+        schedule:
+            interval: "weekly"
+        allow:
+            -   dependency-name: "facebook/php-business-sdk"
+        versioning-strategy: "widen"
+        labels:
+            - "dependencies"
+
+    -   package-ecosystem: "composer"
+        directory: "/"
+        target-branch: "2.x"
+        schedule:
+            interval: "weekly"
+        allow:
+            -   dependency-name: "facebook/php-business-sdk"
+        versioning-strategy: "widen"
+        labels:
+            - "dependencies"
diff --git a/CLAUDE.md b/CLAUDE.md
index 7d9a5c7..f026cdd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -56,4 +56,4 @@ So to add a field: add the public property, map it in `getMapping()`, and regist
 
 **Value objects (`src/ValueObject/`)** — `Fbc`/`Fbp` (extending `Fb`) model the `_fbc`/`_fbp` cookie values with `fromString()` validation and `value()` serialization; assignable to `User::$fbc`/`$fbp` as either the typed object or a raw string.
 
-The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships).
+The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships). Dependabot (`.github/dependabot.yml`, which GitHub only reads from the default branch) watches this one package and opens a PR that widens the constraint when Meta releases a new major, for `1.x` and, through `target-branch`, for `2.x`. CI covers the normalization and hashing on the new major; run `LiveClientTest` once against it before tagging a release.