diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ace460..3bd3654 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,14 @@
 version: 2
+# One grouped pull request per ecosystem per week is the normal case; the cap is what keeps a
+# missed week from compounding into a backlog.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      # Majors are grouped here too: an action pin merges on green with no model either way, so a
+      # separate pull request per major buys nothing but CI minutes.
+      actions:
+        patterns: ["*"]