diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c555689
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,42 @@
+# Keep agentbbs's pinned dependencies current automatically. Dependabot opens
+# (review-gated) PRs when a newer version ships — nothing auto-merges, so a bad
+# bump can't silently reach production.
+#
+# Coverage:
+#   - github-actions : the action pins in .github/workflows/* (checkout, setup-go…)
+#   - gomod          : Go module dependencies (go.mod / go.sum)
+#   - docker         : image tags in the Mailu compose stack and the pod Containerfile
+#
+# NOT covered (Dependabot can't watch shell-string pins): FORGEJO_VERSION and
+# ERGO_VERSION in setup.sh — bump those by hand, or switch to Renovate (which can
+# watch them via a custom regex manager). The Mailu *runtime* patch level is kept
+# current separately by .github/workflows/mailu-update.yml.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-modules:
+        patterns: ["*"]
+
+  # Mailu compose stack — bumps ghcr.io/mailu/* image tags.
+  - package-ecosystem: docker
+    directory: /deploy/mailu
+    schedule:
+      interval: weekly
+
+  # Pod base image (docker.io/library/ubuntu).
+  - package-ecosystem: docker
+    directory: /pods
+    schedule:
+      interval: weekly
diff --git a/setup.sh b/setup.sh
index 9c2eb55..5f4c04c 100755
--- a/setup.sh
+++ b/setup.sh
@@ -52,7 +52,7 @@ IRC_NETWORK="${IRC_NETWORK:-ProfullstackBBS}"  # IRC network name shown to clien
 ERGO_DATA="${ERGO_DATA:-/var/lib/ergo}"  # Ergo state dir (ircd.db, tls/)
 FORGEJO="${FORGEJO:-1}"                  # set 0 to skip the AgentGit Forgejo backend (git.${DOMAIN#*.})
 GIT_DOMAIN="${GIT_DOMAIN:-git.${DOMAIN#*.}}"  # AgentGit host (default: git.<root-of-DOMAIN>, e.g. git.profullstack.com)
-FORGEJO_VERSION="${FORGEJO_VERSION:-11.0.1}"  # Forgejo release to install
+FORGEJO_VERSION="${FORGEJO_VERSION:-11.0.15}"  # Forgejo release to install (latest 11.0.x LTS patch)
 MAIL_STACK="${MAIL_STACK:-1}"       # set 0 to skip the co-located Mailu mail stack (mail.${DOMAIN#*.}). NOT named MAIL: that is a reserved env var (the mail-spool path, e.g. /var/mail/root) which PAM sets under sudo, so a CI deploy inherited MAIL=/var/mail/root and silently dropped the mail Caddy route + §9e provisioning.
 MAIL_DOMAIN="${MAIL_DOMAIN:-mail.${DOMAIN#*.}}"  # mail host (default: mail.<root-of-DOMAIN>, e.g. mail.profullstack.com)
 FORGEJO_HTTP_ADDR="${FORGEJO_HTTP_ADDR:-127.0.0.1:3000}"  # Forgejo loopback HTTP (Caddy fronts it)