diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 70a331d..51afc64 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,6 +20,10 @@ updates:
         update-types:
           - minor
           - patch
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
     ignore:
       # ncc (0.45, the latest) compiles through TypeScript's JS compiler API,
       # which TypeScript 7, the native Go port, does not ship: `pnpm build`