diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 5d3b5cb7a180..000000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Dependabot is the only thing that opens PRs here on its own, as dependabot[bot]:
-# at most one open PR per ecosystem, into develop, reviewed and merged by hand.
-version: 2
-updates:
-  # The TechEngine pin decides how data is validated and how the API is
-  # generated at deploy time, so it moves by PR and passes pr-checks first.
-  - package-ecosystem: gitsubmodule
-    directory: /
-    target-branch: develop
-    schedule:
-      interval: weekly
-      day: tuesday
-      time: "10:17"
-      timezone: Asia/Seoul
-    open-pull-requests-limit: 1
-    assignees: [Seungpyo1007, TechEngineBot]
-    labels: [ci]
-    commit-message:
-      prefix: chore
-      include: scope
-
-  - package-ecosystem: github-actions
-    directory: /
-    target-branch: develop
-    schedule:
-      interval: monthly
-      timezone: Asia/Seoul
-    open-pull-requests-limit: 1
-    groups:
-      actions:
-        patterns: ["*"]
-    assignees: [Seungpyo1007, TechEngineBot]
-    labels: [ci]
-    commit-message:
-      prefix: ci
diff --git a/README.md b/README.md
index 4c00cec176cd..cd0be524c08a 100644
--- a/README.md
+++ b/README.md
@@ -77,8 +77,10 @@ This repo follows git-flow:
 | `feat/*`, `data/*`, `fix/*`, `chore/*` | Short-lived work branches, cut from `develop`. |
 
 A release is a PR from `develop` to `main`; merging it deploys the site.
-Dependabot opens the TechEngine submodule bump (weekly) and GitHub Actions
-updates (monthly) as PRs into `develop`; they are merged by hand like any other.
+The TechEngine pin and the pinned action SHAs are bumped by hand, in a PR into
+`develop` that pr-checks validates like any other. Dependabot can't do it:
+TechEngine carries TechAPI as its own submodule, and Dependabot's recursive
+clone runs out of disk on that loop.
 
 ## Contributing