diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7f6ca80e..4eaa2b57 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -72,7 +72,13 @@ updates:
       interval: monthly
       time: "06:00"
       timezone: "Etc/UTC"
-    open-pull-requests-limit: 10
+    # Version-update PRs disabled (0): the hash-locked CI dev tooling is
+    # regenerated by scripts/update-lockfiles.sh (uv, which honours each row's
+    # target Python via --python-version). Dependabot bumps the .txt directly
+    # and does NOT respect those targets, so every ci-pip group PR broke the
+    # 3.9 rows (dropped `==` pins / pulled py3.10-only pytest/numpy/hypothesis).
+    # Security updates are unaffected by this limit.
+    open-pull-requests-limit: 0
     cooldown:
       default-days: 7
     commit-message: