diff --git a/.scala-steward.conf b/.scala-steward.conf
new file mode 100644
index 00000000..7f143b54
--- /dev/null
+++ b/.scala-steward.conf
@@ -0,0 +1,8 @@
+# JUnit 6.x requires Java 17 at runtime, but this project still targets and
+# tests on JDK 8 (see javacOptions in build.sbt and the test matrix in
+# .github/workflows/CI.yml). Pin JUnit to the 5.x line until JDK 8 support is
+# dropped.
+updates.pin = [
+  { groupId = "org.junit.jupiter", artifactId = "junit-jupiter", version = "5." },
+  { groupId = "org.junit.vintage", artifactId = "junit-vintage-engine", version = "5." }
+]