diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6386fed4..10ca8016 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,38 @@ updates:
     directory: /
     schedule:
       interval: daily
+    labels:
+      - Dependencies
+    # Major updates land as separate PRs so they can be reviewed individually.
+    # Note: only the first matching group applies, so the phpunit group must
+    # come before the catch-all dev-dependencies group.
+    groups:
+      phpunit:
+        patterns:
+          - phpunit/*
+          - sebastian/*
+          - myclabs/*
+          - theseer/*
+          - phar-io/*
+        update-types:
+          - minor
+          - patch
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - Dependencies
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/trunk-upgrade.yml b/.github/workflows/trunk-upgrade.yml
new file mode 100644
index 00000000..8f8a49e6
--- /dev/null
+++ b/.github/workflows/trunk-upgrade.yml
@@ -0,0 +1,42 @@
+name: Trunk Upgrade
+
+on:
+  schedule:
+    # Weekly on Mondays at 06:00 UTC
+    - cron: 0 6 * * 1
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install Trunk CLI
+        uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1
+
+      - name: Upgrade Trunk CLI and linters
+        run: trunk upgrade -y --include-cli
+        env:
+          # Authenticated requests get a higher GitHub API rate limit (pinact).
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff2fa2e423999752927 # v8
+        with:
+          commit-message: "chore: upgrade trunk linters"
+          title: "chore: upgrade trunk linters"
+          body: |
+            Automated `trunk upgrade -y --include-cli` run.
+
+            Review the linter version changes in `.trunk/trunk.yaml` — new linter
+            versions may introduce new findings. Run `trunk check -a` and
+            `trunk fmt` locally if CI reports issues.
+          branch: chore/trunk-upgrade
+          delete-branch: true
+          labels: Dependencies