diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3c6f718..d6fd0fc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,3 +11,14 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    groups:
+      # codeql-action/init and /analyze MUST move together: CodeQL fails with
+      # "Loaded a configuration file for version X, but running version Y" when
+      # they differ, and dependabot proposes each subpath as its own pull
+      # request -- so each one alone is red. Grouping keeps them in one commit.
+      actions:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch