diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..4488ea78
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+# Dependabot version updates: checked weekly for every package ecosystem found in
+# this repo, one PR per available bump, up to 100 open PRs per ecosystem (Dependabot
+# pauses opening more until some are closed). GitHub's default 3-day cooldown on
+# newly published versions applies. Managed org-wide by AppSec.
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 100
+- package-ecosystem: maven
+  directory: /
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 100
+- package-ecosystem: gradle
+  directory: /
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 100