diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 89f81121..e8a35304 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,16 @@ updates:
     groups:
       npm-development:
         dependency-type: development
+    ignore:
+      # typescript-eslint@8.67.0 requires TypeScript <6.1.0; a 7.x bump
+      # broke it before (see the archived
+      # restore-typescript-eslint-compatibility change).
+      - dependency-name: "typescript"
+        versions: [">=6.1.0"]
+      # ESLint 10 drops the directly-imported @eslint/js package and needs a
+      # newer Node.js than this repo's pinned 22.11.0 runtime.
+      - dependency-name: "eslint"
+        versions: [">=10.0.0"]
   - package-ecosystem: github-actions
     directory: /
     schedule:
diff --git a/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/.openspec.yaml b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/.openspec.yaml
new file mode 100644
index 00000000..9a88f355
--- /dev/null
+++ b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-08-25
+skip_specs: true
diff --git a/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/proposal.md b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/proposal.md
new file mode 100644
index 00000000..9f99cb44
--- /dev/null
+++ b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/proposal.md
@@ -0,0 +1,38 @@
+## Why
+
+Found during a repository review session on 2026-08-25: `.github/dependabot.yml`
+groups every dev dependency into one ungated weekly PR
+(`groups.npm-development`, `dependency-type: development`) with no `ignore`
+rules. That grouped PR (#55, "Bump the npm-development group with 9 updates")
+is exactly what previously bumped `typescript` to `7.0.2` and `eslint` to
+`10.8.1`, breaking `typescript-eslint@8.67.0` (which requires TypeScript
+`<6.1.0`) and dropping the directly-imported `@eslint/js` package — fixed in
+the archived `restore-typescript-eslint-compatibility` change by pinning
+`typescript` back to `^6.0.3` and `eslint` to `^9.39.5`. `npm outdated`
+still reports `typescript@7.0.2` as "Latest", so without an `ignore` rule
+Dependabot will propose the same incompatible bump again on its next weekly
+run, silently bundled into the same grouped PR as safe patch updates.
+
+## What Changes
+
+- Add `ignore` entries to the `npm` update block in `.github/dependabot.yml`
+  for `typescript` (versions `>=6.1.0`) and `eslint` (versions `>=10.0.0`),
+  so Dependabot stops proposing the specific bump that broke
+  `typescript-eslint` compatibility, while still proposing every other
+  update in the existing weekly grouped PR.
+- No change to the grouping itself, the schedule, or the `github-actions`
+  update block.
+
+## Capabilities
+
+### New Capabilities
+
+(none)
+
+### Modified Capabilities
+
+(none; this is a CI/tooling configuration change, not a specified behavior)
+
+## Impact
+
+- `.github/dependabot.yml`
diff --git a/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/tasks.md b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/tasks.md
new file mode 100644
index 00000000..23c06b80
--- /dev/null
+++ b/openspec/changes/archive/2026-08-25-pin-dependabot-typescript-eslint/tasks.md
@@ -0,0 +1,14 @@
+## 1. Constrain the risky bumps
+
+- [x] 1.1 Add an `ignore` entry for `typescript` (versions `>=6.1.0`) to the
+  `npm` update block in `.github/dependabot.yml`.
+- [x] 1.2 Add an `ignore` entry for `eslint` (versions `>=10.0.0`) to the
+  same block.
+
+## 2. Verification
+
+- [x] 2.1 `.github/dependabot.yml` parses as valid YAML (verified with
+  `node node_modules/js-yaml/bin/js-yaml.js .github/dependabot.yml`).
+- [x] 2.2 Diff reviewed: no other Dependabot behavior (schedule, grouping,
+  `github-actions` block) changed.
+- [x] 2.3 Run `openspec change validate --strict pin-dependabot-typescript-eslint`.