diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9017dbb..bde7079 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,13 @@
 version: 2
 updates:
-  # The only dependencies this repo has are the actions pinned in
-  # .github/workflows/. Grouped into one PR so related bumps land together
-  # rather than as a stream; CI + dependabot-auto-merge.yml handle the rest.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    # Only offer releases at least a week old, so a hijacked or broken
+    # release is usually pulled before it lands.
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns: ["*"]