diff --git a/.github/workflows/merge-alertmanager.yaml b/.github/workflows/merge-alertmanager.yaml
index 68c407a..dd3fc9b 100644
--- a/.github/workflows/merge-alertmanager.yaml
+++ b/.github/workflows/merge-alertmanager.yaml
@@ -28,6 +28,9 @@ jobs:
          go.sum
          docs/
       restore-downstream: >-
+         .ci-operator.yaml
+         Dockerfile.ocp
+         OWNERS
          .coderabbit.yaml
          .gitignore
       assets-cmd: |
diff --git a/.github/workflows/merge-flow.yaml b/.github/workflows/merge-flow.yaml
index 75c5b97..7104986 100644
--- a/.github/workflows/merge-flow.yaml
+++ b/.github/workflows/merge-flow.yaml
@@ -205,12 +205,12 @@ jobs:
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: "> 11.12.0"
-      - name: Remove dependabot configuration
+      # Upstream CI and bot configs are unused downstream and trigger
+      # security/dependabot alerts if left in place.
+      - name: Remove unused upstream configs
         run: |
-          if [ -f .github/dependabot.yml ]; then
-            git rm -f .github/dependabot.yml
-            git commit -s -m "[bot] remove dependabot config"
-          fi
+          git rm -rf --ignore-unmatch .github/workflows .github/dependabot.yml
+          git diff --cached --exit-code || git commit -s -m "[bot] remove unused upstream configs"
       - name: go mod tidy + vendor
         run: |
           go mod tidy
diff --git a/.github/workflows/merge-kube-state-metrics.yaml b/.github/workflows/merge-kube-state-metrics.yaml
index cb105a2..b3b4006 100644
--- a/.github/workflows/merge-kube-state-metrics.yaml
+++ b/.github/workflows/merge-kube-state-metrics.yaml
@@ -21,7 +21,6 @@ jobs:
       downstream: openshift/kube-state-metrics
       sandbox: rhobs/kube-state-metrics
       restore-upstream: >-
-        .github/ 
         .markdownlint-cli2.jsonc
         CHANGELOG.md
         CONTRIBUTING.md
@@ -30,7 +29,10 @@ jobs:
         VERSION
         docs/
         go.mod
-      restore-downstream: OWNERS
+      restore-downstream: >-
+        .ci-operator.yaml
+        Dockerfile.ocp
+        OWNERS
       downstream-version-expression: |
         sed -n -E 's/^version: \"*([0-9]+\.[0-9]+\.[0-9]+)\"$/v\1/p' https://raw.githubusercontent.com/openshift/kube-state-metrics/main/data.yaml
     secrets:
diff --git a/.github/workflows/merge-metrics-server.yaml b/.github/workflows/merge-metrics-server.yaml
index 5019678..56f5b1e 100644
--- a/.github/workflows/merge-metrics-server.yaml
+++ b/.github/workflows/merge-metrics-server.yaml
@@ -20,7 +20,10 @@ jobs:
       upstream: kubernetes-sigs/metrics-server
       downstream: openshift/kubernetes-metrics-server
       sandbox: rhobs/kubernetes-metrics-server
-      restore-downstream: OWNERS
+      restore-downstream: >-
+        .ci-operator.yaml
+        Dockerfile.ocp
+        OWNERS
       restore-upstream: >-
         go.mod
         go.sum
diff --git a/.github/workflows/merge-node-exporter.yaml b/.github/workflows/merge-node-exporter.yaml
index 4314a3f..b12fce1 100644
--- a/.github/workflows/merge-node-exporter.yaml
+++ b/.github/workflows/merge-node-exporter.yaml
@@ -20,6 +20,8 @@ jobs:
       downstream: openshift/node_exporter
       sandbox: rhobs/node_exporter
       restore-downstream: >-
+         .ci-operator.yaml
+         Dockerfile.ocp
          OWNERS
       restore-upstream: >-
          CHANGELOG.md
@@ -27,7 +29,6 @@ jobs:
          collector
          go.mod
          go.sum
-         .github/workflows/
     secrets:
       pr-app-id: ${{ secrets.APP_ID }}
       pr-app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/merge-prom-label-proxy.yaml b/.github/workflows/merge-prom-label-proxy.yaml
index 92ae634..a1414f3 100644
--- a/.github/workflows/merge-prom-label-proxy.yaml
+++ b/.github/workflows/merge-prom-label-proxy.yaml
@@ -20,6 +20,8 @@ jobs:
       downstream: openshift/prom-label-proxy
       sandbox: rhobs/prom-label-proxy
       restore-downstream: >-
+         .ci-operator.yaml
+         Dockerfile.ocp
          OWNERS
       restore-upstream: >-
          CHANGELOG.md
diff --git a/.github/workflows/merge-prometheus-operator.yaml b/.github/workflows/merge-prometheus-operator.yaml
index 965c316..74d651e 100644
--- a/.github/workflows/merge-prometheus-operator.yaml
+++ b/.github/workflows/merge-prometheus-operator.yaml
@@ -30,6 +30,12 @@ jobs:
         scripts/go.mod
         scripts/go.sum
         pkg
+      restore-downstream: >-
+        .ci-operator.yaml
+        Dockerfile.ocp
+        Dockerfile.admission-webhook.ocp
+        Dockerfile.config-reloader.ocp
+        OWNERS
     secrets:
       pr-app-id: ${{ secrets.APP_ID }}
       pr-app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/merge-prometheus.yaml b/.github/workflows/merge-prometheus.yaml
index d2bdf41..c1b8c1d 100644
--- a/.github/workflows/merge-prometheus.yaml
+++ b/.github/workflows/merge-prometheus.yaml
@@ -20,7 +20,10 @@ jobs:
       downstream: openshift/prometheus
       sandbox: rhobs/prometheus
       restore-downstream: >-
+        .ci-operator.yaml
         .github/PULL_REQUEST_TEMPLATE.md
+        Dockerfile.ocp
+        OWNERS
       restore-upstream: >-
         CHANGELOG.md
         VERSION
diff --git a/.github/workflows/merge-resource-state-metrics.yaml b/.github/workflows/merge-resource-state-metrics.yaml
index 70ff4ba..a6c0ee2 100644
--- a/.github/workflows/merge-resource-state-metrics.yaml
+++ b/.github/workflows/merge-resource-state-metrics.yaml
@@ -20,9 +20,11 @@ jobs:
       upstream: kubernetes-sigs/resource-state-metrics
       downstream: openshift/kubernetes-sigs-resource-state-metrics
       sandbox: rhobs/kubernetes-sigs-resource-state-metrics
-      restore-downstream: OWNERS
+      restore-downstream: >-
+        .ci-operator.yaml
+        Dockerfile.ocp
+        OWNERS
       restore-upstream: >-
-        .github/
         CONTRIBUTING.md
         Dockerfile
         README.md
diff --git a/.github/workflows/merge-thanos.yaml b/.github/workflows/merge-thanos.yaml
index 818ebd4..a3b0dfa 100644
--- a/.github/workflows/merge-thanos.yaml
+++ b/.github/workflows/merge-thanos.yaml
@@ -29,6 +29,10 @@ jobs:
         tutorials
         .busybox-versions
         .devcontainer
+      restore-downstream: >-
+        .ci-operator.yaml
+        Dockerfile.ocp
+        OWNERS
     secrets:
       pr-app-id: ${{ secrets.APP_ID }}
       pr-app-private-key: ${{ secrets.APP_PRIVATE_KEY }}