diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b624db54c..3a7da43e5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,25 +1,21 @@
 version: 2
 updates:
-  # Enable version updates for npm
-  - package-ecosystem: 'npm'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-    open-pull-requests-limit: 5
-    reviewers:
-      - 'dt'
-    commit-message:
-      prefix: 'chore(deps)'
-      include: 'scope'
-    labels:
-      - 'dependencies'
-      - 'automated'
-
   # GitHub Actions updates
+  #
+  # npm version updates were removed here (2026-09-04): package.json has no
+  # runtime `dependencies`, only 3 devDependencies (husky, lint-staged,
+  # prettier) that never reach a user — flow-cli ships as zsh through
+  # Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and
+  # only 6 merged, each costing a full CI run (ZSH Plugin Tests alone ~7min).
+  # github-actions updates merged 3/3 and cover real security surface (e.g.
+  # #444 bumped actions/create-github-app-token, the action #514 later
+  # hardened) — kept.
   - package-ecosystem: 'github-actions'
     directory: '/'
+    # Open PRs against the integration branch. Without this, dependabot derives
+    # the base from the repo default (main) and RESETS it on every rebase, so a
+    # manual retarget to dev can never stick (observed on #503 and #512).
+    target-branch: 'dev'
     schedule:
       interval: 'weekly'
       day: 'monday'
diff --git a/package-lock.json b/package-lock.json
index 5da012323..de212d208 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "devDependencies": {
         "husky": "^9.1.7",
         "lint-staged": "^17.4.1",
-        "prettier": "^3.9.4"
+        "prettier": "^3.9.6"
       }
     },
     "node_modules/husky": {
@@ -68,9 +68,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.4",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz",
-      "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==",
+      "version": "3.9.6",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
+      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
       "dev": true,
       "license": "MIT",
       "bin": {
diff --git a/package.json b/package.json
index 4b8bdb7a1..1b48edbe0 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "devDependencies": {
     "husky": "^9.1.7",
     "lint-staged": "^17.4.1",
-    "prettier": "^3.9.4"
+    "prettier": "^3.9.6"
   },
   "lint-staged": {
     "*.{json,md,yml,yaml}": [