diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 77c3686c..4e089f4f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,105 +13,64 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
-  # Rust/Cargo - root workspace
+  # Rust/Cargo - group the same dependency across the workspace crates
   - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "daily"
-
-  # Rust/Cargo - standalone crates
-    ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-  - package-ecosystem: "cargo"
-    directory: "/czech-file-knife"
-    schedule:
-      interval: "daily"
-    ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-
-  - package-ecosystem: "cargo"
-    directory: "/panoptes"
-    schedule:
-      interval: "daily"
-    ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-
-  - package-ecosystem: "cargo"
-    directory: "/personal-sysadmin"
+    directories:
+      - "/"
+      - "/czech-file-knife"
+      - "/panoptes"
+      - "/personal-sysadmin"
+      - "/displace"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 3
+    groups:
+      shared-rust-dependencies:
+        group-by: dependency-name
     ignore:
       # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
       # ignore semver-major bumps so they land via author-supplied PRs
       # paired with call-site updates. Minor + patch flow normally.
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
-
-  - package-ecosystem: "cargo"
-    directory: "/displace"
-    schedule:
-      interval: "daily"
-
   # Elixir/Mix
-    ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
   - package-ecosystem: "mix"
     directory: "/"
     schedule:
       interval: "daily"
-
-  # Node.js/npm
+    open-pull-requests-limit: 2
     ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+
+  # Node.js/npm
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
-
-  # Python/pip
+    open-pull-requests-limit: 2
     ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+
+  # Python/pip
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "daily"
-
-  # Nix flakes
+    open-pull-requests-limit: 2
     ignore:
-      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
-      # ignore semver-major bumps so they land via author-supplied PRs
-      # paired with call-site updates. Minor + patch flow normally.
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+
+  # Nix flakes
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
       interval: "daily"
+    open-pull-requests-limit: 2
     ignore:
       # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
       # ignore semver-major bumps so they land via author-supplied PRs
diff --git a/personal-sysadmin/scripts/github-admin/add-missing-files.sh b/personal-sysadmin/scripts/github-admin/add-missing-files.sh
index 8876ee9b..f706a8f7 100755
--- a/personal-sysadmin/scripts/github-admin/add-missing-files.sh
+++ b/personal-sysadmin/scripts/github-admin/add-missing-files.sh
@@ -10,8 +10,11 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    groups:
+      actions:
+        patterns: ["*"]
 '
 
 # Standard FUNDING.yml content
diff --git a/personal-sysadmin/scripts/setup-new-repo.sh b/personal-sysadmin/scripts/setup-new-repo.sh
index a64c8425..717dc863 100755
--- a/personal-sysadmin/scripts/setup-new-repo.sh
+++ b/personal-sysadmin/scripts/setup-new-repo.sh
@@ -74,8 +74,11 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    groups:
+      actions:
+        patterns: ["*"]
 DEP
     gh api "repos/$OWNER/$REPO/contents/.github/dependabot.yml" -X PUT \
         -f message="Add dependabot configuration" \