diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d98bf74..54173ee 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,8 @@
-# Dependabot security updates only. Version updates stay manual: open-pull-requests-limit: 0
-# turns them off, while security updates still open PRs for every new alert.
-# cooldown mirrors pnpm's minimumReleaseAge (24 h). GitHub applies it to version updates only,
-# so it does not delay security PRs: check the fixed version's age before merging one.
+# Dependabot security updates only. open-pull-requests-limit: 0 turns version updates off; security
+# updates, once enabled in the repo's code security settings, open a PR for each new alert.
+# cooldown mirrors pnpm's minimumReleaseAge (24 h), but it only delays version updates. Security PRs
+# skip both: GitHub ignores cooldown for them, and Dependabot runs pnpm with
+# --config.minimumReleaseAge=0 (dependabot-core#15170). Check the fixed version's age before merging.
 version: 2
 updates:
   - package-ecosystem: npm