diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fbf99ed..240120a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,13 @@ updates:
     groups:
       uv-minor-patch:
         update-types: ["minor", "patch"]
+      # Security updates are a separate stream; without this group they arrive one PR per
+      # advisory, which is what built the queues that got bulk-closed. A GROUPED PR is also
+      # the only kind `@dependabot unignore` works on. Canonical shape: dependency-policy
+      # templates/tier*.yml.
+      uv-security:
+        applies-to: security-updates
+        patterns: ["*"]
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -36,6 +43,13 @@ updates:
     groups:
       github-actions-minor-patch:
         update-types: ["minor", "patch"]
+      # Security updates are a separate stream; without this group they arrive one PR per
+      # advisory, which is what built the queues that got bulk-closed. A GROUPED PR is also
+      # the only kind `@dependabot unignore` works on. Canonical shape: dependency-policy
+      # templates/tier*.yml.
+      github-actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]