diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 96f674e..260736c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,6 +22,9 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # squawk-cli's >=2.0 floor is intentionally broad so consumers can pin any
+      # squawk 2.x via additional_dependencies. Do not let Dependabot tighten it.
+      - dependency-name: "squawk-cli"
 
   # GitHub Actions
   - package-ecosystem: "github-actions"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6789dc8..a0d6135 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,7 +64,12 @@ jobs:
           fi
           echo "Versions match: $PYPROJECT_VERSION"
 
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
+          # Dependabot never bumps the package version, only dependencies, so
+          # exempt it from the version-bump requirement or its dependency PRs
+          # (which edit pyproject.toml) would always fail this check. Key off the
+          # PR author, not github.actor: actor becomes the human on an Update-branch
+          # or manual push, which would wrongly re-enable the check on a bot PR.
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ github.event.pull_request.user.login }}" != "dependabot[bot]" ]; then
             git fetch origin main --depth=1
             MAIN_VERSION=$(git show origin/main:pyproject.toml | python -c "import sys, tomllib; print(tomllib.loads(sys.stdin.read())['tool']['poetry']['version'])" || true)
             if [ -z "$MAIN_VERSION" ]; then