diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8ec4ecf..55cf524 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,11 +9,47 @@ updates:
         dependency-type: production
       development-dependencies:
         dependency-type: development
+    ignore:
+      # The shell's React (and its types) must match the pinned ZenNotes
+      # source (.zennotes-commit); a second React or diverging @types/react
+      # breaks the pinned-source typecheck. These move with the pin only.
+      - dependency-name: react
+      - dependency-name: react-dom
+      - dependency-name: "@types/react"
+      - dependency-name: "@types/react-dom"
+      # Libraries app-core imports through the shell's node_modules follow
+      # the pin's versions too; majors are never a drive-by.
+      - dependency-name: "@codemirror/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: katex
+        update-types: ["version-update:semver-major"]
+      - dependency-name: mermaid
+        update-types: ["version-update:semver-major"]
+      - dependency-name: jsxgraph
+        update-types: ["version-update:semver-major"]
+      - dependency-name: zustand
+        update-types: ["version-update:semver-major"]
+      # Toolchain majors come with config migrations (TS 7 drops baseUrl,
+      # Tailwind 4 replaces its config, Vite 8) — upgraded deliberately.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+      - dependency-name: vite
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@vitejs/plugin-react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: tailwindcss
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: gradle
     directory: /android
     schedule:
       interval: weekly
+    ignore:
+      # Gradle 9 needs an AGP that supports it; upgrade the two together.
+      - dependency-name: gradle-wrapper
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /