diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..17f8df7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+# VOLPAROSSA maintenance: changes are proposed, never auto-merged.
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+  open-pull-requests-limit: 3
+  groups:
+    volparossa-security:
+      applies-to: security-updates
+      patterns:
+      - '*'