diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index fb3963c..dc3d6cf 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -20,7 +20,7 @@ jobs:
         run: ./generate.sh
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5.6.0
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -33,14 +33,19 @@ jobs:
         run: mvn resources:resources --file src/pom.xml
 
       - name: Test
+        if: ${{ github.actor != 'dependabot[bot]' }}
         run: mvn --batch-mode -Dmaven.test.failure.ignore=true test --file src/pom.xml
         env:
           DATASET_ID: ${{secrets.INTEGRATIONTESTS_DATASET_ID}}
           API_KEY: ${{secrets.INTEGRATIONTESTS_API_KEY}}
 
+      - name: Unit tests
+        if: ${{ github.actor == 'dependabot[bot]' }}
+        run: mvn --batch-mode -DexcludedGroups=integration test --file src/pom.xml
+
       - name: Report
-        uses: dorny/test-reporter@v1
-        if: always()
+        uses: dorny/test-reporter@v3
+        if: ${{ always() && github.actor != 'dependabot[bot]' }}
         with:
           name: Maven Tests
           path: src/target/surefire-reports/*.xml
diff --git a/.github/workflows/generate-api-version.yml b/.github/workflows/generate-api-version.yml
index 1201c43..ffa5a80 100644
--- a/.github/workflows/generate-api-version.yml
+++ b/.github/workflows/generate-api-version.yml
@@ -81,7 +81,7 @@ jobs:
           "Resolved Relewise.Client version $version." >> $env:GITHUB_STEP_SUMMARY
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5.6.0
         with:
           java-version: '17'
           distribution: 'temurin'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 38967d8..12f60c7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -28,7 +28,7 @@ jobs:
         run: ./generate.sh
 
       - name: Set up JDK 17 and Maven Central auth
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'temurin'
           java-version: '17'
diff --git a/AGENTS.md b/AGENTS.md
index 432b0fd..f54040f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -76,9 +76,16 @@ Run tests:
 mvn --batch-mode test --file src/pom.xml
 ```
 
+Run tests that do not require integration credentials:
+
+```powershell
+mvn --batch-mode -DexcludedGroups=integration test --file src/pom.xml
+```
+
 ## Testing and Credentials
-- Tests use `DATASET_ID` and `API_KEY` from environment (`TestBase`).
+- Integration tests inherit the `integration` tag and use `DATASET_ID` and `API_KEY` from the environment (`TestBase`).
 - CI injects credentials from secrets.
+- CI excludes integration tests when triggered by Dependabot.
 - If credentials are unavailable locally, explicitly report integration-style test coverage as not run.
 
 ## Validation Policy (CI-Aligned, Pragmatic)
diff --git a/src/src/test/java/com/relewise/client/ClientConstructionTest.java b/src/src/test/java/com/relewise/client/ClientConstructionTest.java
index 71bd4ab..4981ac0 100644
--- a/src/src/test/java/com/relewise/client/ClientConstructionTest.java
+++ b/src/src/test/java/com/relewise/client/ClientConstructionTest.java
@@ -7,7 +7,7 @@
 
 import static org.junit.jupiter.api.Assertions.*;
 
-public class ClientConstructionTest extends TestBase {
+public class ClientConstructionTest {
     @Test
     public void testApiKeyEmpty() {
         assertThrows(IllegalArgumentException.class, () -> new Tracker("00000000-0000-0000-0000-000000000001", "", "https://api.relewise.com/"));
@@ -24,4 +24,4 @@ public void testApiKeyValid() {
 
         assertNotNull(tracker);
     }
-}
\ No newline at end of file
+}
diff --git a/src/src/test/java/com/relewise/client/DateTimeSerializationTest.java b/src/src/test/java/com/relewise/client/DateTimeSerializationTest.java
index a983069..405aa4c 100644
--- a/src/src/test/java/com/relewise/client/DateTimeSerializationTest.java
+++ b/src/src/test/java/com/relewise/client/DateTimeSerializationTest.java
@@ -14,7 +14,7 @@
 
 import static org.junit.jupiter.api.Assertions.*;
 
-public class DateTimeSerializationTest extends TestBase {
+public class DateTimeSerializationTest {
     @Test
     public void testSerializeOffsetDateTime() throws Exception {
         var objectMapper = JsonMapper.builder()
@@ -42,4 +42,4 @@ public void testSerializeLocalDateTime() throws Exception {
 
         assertEquals("\"" + input + "\"", serialized);
     }
-}
\ No newline at end of file
+}
diff --git a/src/src/test/java/com/relewise/client/TestBase.java b/src/src/test/java/com/relewise/client/TestBase.java
index 2825503..d1774fb 100644
--- a/src/src/test/java/com/relewise/client/TestBase.java
+++ b/src/src/test/java/com/relewise/client/TestBase.java
@@ -1,5 +1,8 @@
 package com.relewise.client;
 
+import org.junit.jupiter.api.Tag;
+
+@Tag("integration")
 public abstract class TestBase {
 
     public static String GetDatasetId() {