diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..606484c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+# Keeps dependencies and CI actions current (security alerts are on separately). Once a month,
+# minor and patch updates are grouped into one pull request per ecosystem and folder; a major
+# version comes as its own pull request and is reviewed before merging. CI checks every update.
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      maven-minor-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions-minor-patch:
+        update-types: [minor, patch]
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index bdbda8a..589c1d4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -8,12 +8,17 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  schedule:
+    # Weekly, without a code change: a broken dependency or a change outside the repository
+    # shows up within a week (night in India, before the daily Quality Intelligence collection)
+    - cron: '15 23 * * 2'   # Tuesday 23:15 UTC
   # Allows a manual run from the Actions tab
   workflow_dispatch:
 
 # A newer push to the same branch cancels the run that is still going.
+# Grouped per event too, so the weekly run and a push run on main never cancel each other
 concurrency:
-  group: tests-${{ github.ref }}
+  group: tests-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 permissions:
diff --git a/README.md b/README.md
index 69a5dd8..0ae36ff 100644
--- a/README.md
+++ b/README.md
@@ -142,6 +142,8 @@ It shows:
 
 `.github/workflows/tests.yml` runs every scenario with `mvn clean test -Dheadless=true` in Chrome on every push and pull request (JDK 17, Maven cache). The custom HTML report, Cucumber's reports and the screenshots of failed scenarios are kept as the run's **cucumber-reports** artifact, and the badge at the top shows the latest result. [Automation Coverage & Quality Intelligence](https://github.com/niranjankagri/automation-coverage-quality-intelligence) reads `cucumber.xml` from that artifact for its cross-repository dashboard.
 
+CI also runs every Tuesday at 23:15 UTC without a code change, so a broken dependency or a change outside the repository shows up within a week. Dependabot proposes dependency and GitHub Actions updates once a month (minor and patch updates grouped, major versions as separate pull requests).
+
 `main` is protected by a ruleset: every change goes through a pull request, and this CI job must pass before it is merged.
 
 ## Configuration