diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e6e1a7d..b92b54a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,8 @@
-# Dependabot security updates only. Version updates stay manual: open-pull-requests-limit: 0
-# turns them off, while security updates still open PRs for every new alert.
-# cooldown mirrors pnpm's minimumReleaseAge (24 h). GitHub applies it to version updates only,
-# so it does not delay security PRs: check the fixed version's age before merging one.
+# Dependabot security updates only. open-pull-requests-limit: 0 turns version updates off; security
+# updates, once enabled in the repo's code security settings, open a PR for each new alert.
+# cooldown mirrors pnpm's minimumReleaseAge (24 h), but it only delays version updates. Security PRs
+# skip both: GitHub ignores cooldown for them, and Dependabot runs pnpm with
+# --config.minimumReleaseAge=0 (dependabot-core#15170). Check the fixed version's age before merging.
 version: 2
 updates:
   - package-ecosystem: npm
diff --git a/README.md b/README.md
index f836a1e..1a52c0a 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,7 @@ New dependency versions must be at least 24 h old before they get in. Most malic
 
   The same flag works with `npm update`. Then run `mise run check-dist` and commit the rebuilt `dist/` together with the lockfile.
 - **Global npm CLI** in `setup-pnpm` and `setup-pnpm-bun`: an exact version, bumped by hand to a release at least 24 h old (see the comment on the "Update npm" step). Both actions are deprecated in favor of mise, which uses the npm bundled with the locked Node.
-- **Security updates**: Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`.
+- **Security updates**: once security updates are enabled in the repo settings, Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`. Its PRs also skip the 24 h cooldown (GitHub ignores `cooldown` for security updates, and Dependabot runs pnpm with `minimumReleaseAge=0`), so check the fixed version's publish date before merging one.
 
 ## Security linting