diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1d1a973..1ef0f6d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,12 @@ updates:
       include: "scope"
     groups:
       all-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+      security-minor-patch:
+        applies-to: security-updates
         update-types:
           - "minor"
           - "patch"
@@ -36,4 +42,9 @@ updates:
       - "github-actions"
     commit-message:
       prefix: "ci"
-      include: "scope"
\ No newline at end of file
+      include: "scope"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index f32825c..630a424 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -12,8 +12,14 @@ jobs:
     steps:
       - uses: dependabot/fetch-metadata@v3
         id: meta
-      - name: Auto-merge patch and minor updates
-        if: steps.meta.outputs.update-type != 'version-update:semver-major'
+      - name: Auto-merge Dependabot's minor/patch group PRs
+        # Merge only PRs Dependabot itself filed as a minor/patch group. Group
+        # membership is decided from versions Dependabot could actually compare;
+        # anything outside a group is a major, a security update, or a
+        # requirement range it could not classify. fetch-metadata's update-type
+        # is not a safe gate for those: Claude-Patent-Creator #82 widened mcp
+        # from <2.0.0 to <3.0.0 and it reported "version-update:semver-patch".
+        if: endsWith(steps.meta.outputs.dependency-group, 'minor-patch')
         run: gh pr merge "$PR_URL" --auto --squash
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}