diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..cab9c31
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,44 @@
+version: 2
+updates:
+  # The npm entry sits at the root because that is where the single lockfile
+  # is: root, server and web are one npm workspace, so one entry covers all
+  # three. Pointing entries at server/ or web/ would find package.json files
+  # with no lockfile beside them and update nothing.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      # Everything routine arrives as one PR a week, so the dashboard is not
+      # the only place these get noticed. Majors are deliberately left out of
+      # the group: they are migrations, not bumps -- vitest 3 to 4 is one --
+      # and each deserves its own PR and its own CI run.
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      actions:
+        patterns:
+          - "*"
+  # The runtime and build stages both pin node:22-alpine, so this is what
+  # keeps the published container images off a stale base between the weekly
+  # releases.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
diff --git a/package-lock.json b/package-lock.json
index f3691f2..628e4e7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2133,9 +2133,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.3",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.3.tgz",
-      "integrity": "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -3830,7 +3830,7 @@
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@hono/node-server": "^1.13.8",
-        "hono": "^4.7.4"
+        "hono": "^4.13.7"
       },
       "devDependencies": {
         "@types/node": "^22.13.10",
diff --git a/server/package.json b/server/package.json
index 14bf68d..4044769 100644
--- a/server/package.json
+++ b/server/package.json
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.13.8",
-    "hono": "^4.7.4"
+    "hono": "^4.13.7"
   },
   "devDependencies": {
     "@types/node": "^22.13.10",