diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f6e3a1dc2f..d03ec0e266 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,7 @@ updates:
       default-days: 3
     allow:
       - dependency-name: '@metamask/*'
+      - dependency-name: '@lavamoat/*'
     versioning-strategy: 'increase'
 
   - package-ecosystem: 'github-actions'
diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml
new file mode 100644
index 0000000000..ac032ad096
--- /dev/null
+++ b/.github/workflows/repair-dependabot-pull-requests.yml
@@ -0,0 +1,92 @@
+name: Repair Dependabot pull requests
+
+on:
+  pull_request:
+    # Deliberately not `synchronize`: this job pushes to the pull request branch, and reacting to its own push would loop.
+    types:
+      - opened
+      - reopened
+
+permissions:
+  contents: read
+
+jobs:
+  repair:
+    name: Repair constraints, lockfile and changelogs
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Dependabot runs get a read-only `GITHUB_TOKEN` and no repository secrets, so the push is authorised by an OIDC exchange instead.
+      - name: Get access token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
+            pull_requests: write
+
+      - name: Check out the pull request branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Configure Git
+        run: |
+          git config user.name 'metamask-ci[bot]'
+          git config user.email '271559518+metamask-ci[bot]@users.noreply.github.com'
+
+      - name: Get merge base
+        id: merge-base
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          set -euo pipefail
+          echo "merge-base=$(git merge-base HEAD "refs/remotes/origin/$BASE_REF")" >> "$GITHUB_OUTPUT"
+
+      - name: Set up environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+
+      - name: Align dependency ranges
+        env:
+          ALIGN_DEPENDENCY_RANGES: 'true'
+        run: yarn constraints --fix
+
+      # `--no-immutable` because the step above changed ranges, so this install has to be allowed to rewrite the lockfile. Without it Yarn fails with YN0028 in CI.
+      - name: Apply dependency range updates
+        run: yarn install --no-immutable
+
+      - name: Deduplicate dependency tree
+        run: yarn dedupe
+
+      - name: Write changelog entries for the bumped dependencies
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          MERGE_BASE: ${{ steps.merge-base.outputs.merge-base }}
+          CHANGELOG_BASE_REF: ${{ steps.merge-base.outputs.merge-base }}
+        run: yarn changelog:validate --checkDeps --fix --currentPr "$PR_NUMBER" --fromRef "$MERGE_BASE"
+        # Entries can be written even when other validation errors remain, and those are still worth committing.
+        continue-on-error: true
+
+      - name: Commit and push the repairs
+        env:
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          TOKEN: ${{ steps.get-token.outputs.token }}
+        run: |
+          set -euo pipefail
+
+          if git diff --quiet; then
+            echo 'Nothing to repair.'
+            exit 0
+          fi
+
+          git add -- '**/package.json' package.json yarn.lock '**/CHANGELOG.md'
+          git commit -m '[dependabot skip] chore: align dependency ranges, deduplicate lockfile and update changelogs'
+          git push "https://x-access-token:${TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:$PR_HEAD_REF"