diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index acd832a..d63e539 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,5 +1,6 @@
 # Dependabot version updates: monthly, grouped so each ecosystem yields one PR for
-# minor and patch bumps; major bumps come as separate PRs.
+# minor and patch bumps. Major bumps are ignored for packages and base images (they are
+# taken deliberately by hand); GitHub Actions majors are still proposed.
 version: 2
 updates:
   - package-ecosystem: github-actions
@@ -16,3 +17,6 @@ updates:
     groups:
       minor-and-patch:
         update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]