diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2be0e9054..9d6edda2f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,12 +3,32 @@ updates:
   - package-ecosystem: cargo
     directory: "/ci"
     schedule:
-      interval: daily
+      interval: weekly
+      day: monday
       time: "11:00"
     open-pull-requests-limit: 10
+    groups:
+      cargo-minor-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [minor, patch]
+      cargo-security:
+        applies-to: security-updates
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
+      interval: weekly
+      day: monday
       time: "11:00"
     open-pull-requests-limit: 10
+    groups:
+      actions-minor-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [minor, patch]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
deleted file mode 100644
index 8bf9ccd23..000000000
--- a/.github/workflows/auto-merge.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: auto-merge
-
-on:
-  pull_request:
-
-jobs:
-  auto-merge:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: ahmadnassri/action-dependabot-auto-merge@v2
-        with:
-          github-token: ${{ secrets.AUTOMERGE_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec5063075..d82825e17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,3 +94,41 @@ jobs:
           gh api "repos/$REPO/issues/$PR/comments" \
             -f body=@/tmp/render-comment.txt \
             --silent
+
+  dependabot-merge:
+    needs: [readme-check, render]
+    if: >-
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Keep the merge credential isolated from the jobs that execute PR code.
+      - name: Verify Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+
+      - name: Merge minor and patch updates after CI passes
+        if: >-
+          (steps.metadata.outputs.package-ecosystem == 'cargo' ||
+           steps.metadata.outputs.package-ecosystem == 'github_actions') &&
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+           steps.metadata.outputs.update-type == 'version-update:semver-patch')
+        env:
+          # Use the existing Dependabot secret so the merge triggers the
+          # list-generation workflow and its website rebuild event.
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::error::Set the AUTOMERGE_TOKEN Dependabot secret."
+            exit 1
+          fi
+
+          gh pr merge "$PR_URL" --squash --match-head-commit "$HEAD_SHA"