diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index dcbe29d..fe8398b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,6 +10,11 @@ updates:
     schedule:
       interval: weekly
     groups:
+      # onnxruntime_go in this group is version-coupled to the OrtVersion
+      # constant in pkg/embed/download.go (see the comment there): a bump here
+      # with no matching OrtVersion bump ships a binary that requests an ORT
+      # API version the downloaded library doesn't support, and nothing in CI
+      # catches it. Check the diff for onnxruntime_go before merging this group.
       go-dependencies:
         patterns: ["*"]
     open-pull-requests-limit: 3
diff --git a/pkg/embed/download.go b/pkg/embed/download.go
index d0c95c1..a57e05b 100644
--- a/pkg/embed/download.go
+++ b/pkg/embed/download.go
@@ -15,14 +15,14 @@ import (
 	"time"
 )
 
-// OrtVersion is the ONNX Runtime release whose C API onnxruntime_go v1.31.0
+// OrtVersion is the ONNX Runtime release whose C API onnxruntime_go v1.33.0
 // is built against. The two are coupled: the binding compiles against one
 // version of the headers and dlopens whatever this constant downloaded, so
 // bumping the Go module without bumping this constant produces a binary that
 // loads a library it was not compiled for. Nothing in CI catches that — the
 // tests skip inference when no model is installed — so the versions move
 // together, in one commit, or not at all.
-const OrtVersion = "1.26.0"
+const OrtVersion = "1.29.0"
 
 // OrtDownloadURL returns the GitHub release URL for the ORT shared library
 // archive for the current platform.