diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5f5a57a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+# Dependabot only reads this file from the default branch, 2.x, which is also the only branch it watches.
+#
+# Only facebook/php-business-sdk is watched. The Graph API version the client talks to is ApiConfig::APIVersion from that
+# package, and Meta ships a new major of it for every Graph API version, a few times a year. Without a PR that widens the
+# constraint, users of this library stay capped at the previous Graph API version.
+#
+# No composer.lock is committed, so a PR is only opened when a release falls outside the allowed range, i.e. for a new
+# major. The other dependencies are left out on purpose: their ranges already float, and the dev tools are held on the
+# majors that still support PHP 8.1.
+version: 2
+
+updates:
+    -   package-ecosystem: "composer"
+        directory: "/"
+        schedule:
+            interval: "weekly"
+        allow:
+            -   dependency-name: "facebook/php-business-sdk"
+        versioning-strategy: "widen"
+        labels:
+            - "dependencies"
diff --git a/CLAUDE.md b/CLAUDE.md
index f19c5af..cda4349 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,7 +31,7 @@ CI (`.github/workflows/build.yaml`) runs coding standards, dependency analysis,
 
 ### Branches
 
-There is no `master`. **`1.x`** is the default branch and holds the released 1.x line: bug fixes and additive changes only, and the BC check must stay green — this is a public library. **`2.x`** is the next major: BC breaks are allowed there, but every one must be documented in `UPGRADE-2.0.md`. Because the BC check compares against the PR's base, it is expected to be red on `2.x` PRs that break BC; its output should match what `UPGRADE-2.0.md` lists. Always pass `--base` to `gh pr create`. `Closes #123` only auto-closes issues when merged into the default branch, so issues fixed on `2.x` have to be closed by hand.
+There is no `master`. **`2.x`** is the default branch and the next major: BC breaks are allowed there, but every one must be documented in `UPGRADE-2.0.md`. Because the BC check compares against the PR's base, it is expected to be red on `2.x` PRs that break BC; its output should match what `UPGRADE-2.0.md` lists. **`1.x`** holds the released 1.x line: bug fixes and additive changes only, and the BC check must stay green there — this is a public library. Always pass `--base` to `gh pr create`. `Closes #123` only auto-closes issues when merged into the default branch, so issues fixed on `1.x` have to be closed by hand. Config that GitHub only reads from the default branch, like `.github/dependabot.yml`, lives on `2.x` only.
 
 ### LiveClientTest
 
@@ -62,4 +62,4 @@ So to add a field: add the public property, map it in `getMapping()`, and regist
 
 **Value objects (`src/ValueObject/`)** — `Fbc`/`Fbp` (extending `Fb`) model the `_fbc`/`_fbp` cookie values with `fromString()` validation and `value()` serialization; assignable to `User::$fbc`/`$fbp` as either the typed object or a raw string. Both accept the optional trailing appendix segment that Meta's parameter builder writes (`getAppendix()`/`withAppendix()`) and write it back unchanged, so a cookie value round-trips byte for byte.
 
-The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships).
+The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships). Dependabot (`.github/dependabot.yml`) watches this one package on `2.x` and opens a PR that widens the constraint when Meta releases a new major; `1.x` is not watched. CI covers the normalization and hashing on the new major; run `LiveClientTest` once against it before tagging a release.