diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9722b0218d..b0922574ff 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,17 +18,23 @@ updates:
         update-types:
           - "version-update:semver-major"
       - dependency-name: "openai/codex-action"
+        # NOTE: this ecosystem's `versions` strings are parsed as Ruby
+        # Gem::Requirement (RubyGems comparator syntax), NOT npm-style semver
+        # ranges — "1.12.x" is not a wildcard here, it parses as a literal
+        # (and never-matching) version string, which is why the prior attempt
+        # at this silently failed to block v1.12 (PR #6541, 2026-09-09). Use
+        # real comparators instead.
         versions:
-          - "1.12.x"
+          - ">= 1.12, < 1.13"
         # Deliberately pinned to v1.11 in ai-review.yml — v1.12 has two
         # confirmed, still-open upstream regressions: a wrapper-level hang
         # (openai/codex-action#151) and a runner-killing failure
         # (openai/codex-action#160). A grouped Dependabot bump already
         # silently reintroduced v1.12 once (PR #6484, 2026-09-07). Scoped to
-        # 1.12.x (not a blanket ignore) so Dependabot still proposes v1.13+
-        # once a fix ships; evaluate any such proposal in its own deliberate
-        # PR, checking the upstream changelog/issue tracker first — never
-        # bundle it into the actions-major group.
+        # the 1.12 line (not a blanket ignore) so Dependabot still proposes
+        # v1.13+ once a fix ships; evaluate any such proposal in its own
+        # deliberate PR, checking the upstream changelog/issue tracker first
+        # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
   - package-ecosystem: "gomod"