diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 49156cb..77c3686 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,20 +21,44 @@ updates:
       interval: "daily"
 
   # Rust/Cargo - standalone crates
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "cargo"
     directory: "/czech-file-knife"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/panoptes"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/personal-sysadmin"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/displace"
@@ -42,25 +66,55 @@ updates:
       interval: "daily"
 
   # Elixir/Mix
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "mix"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Node.js/npm
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Python/pip
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Nix flakes
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]