diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 633f879..0a2cdd8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -15,3 +15,8 @@
 
 # Everything else
 *                     @manish-9245 @scoder5
+
+# Website dependency bumps: no owner, so the bot's approval is enough once required checks pass.
+# These must stay after `*` — the last matching pattern wins, and an ownerless line removes ownership.
+/web/package.json
+/web/package-lock.json
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
new file mode 100644
index 0000000..01580c6
--- /dev/null
+++ b/.github/workflows/dependabot-automerge.yml
@@ -0,0 +1,58 @@
+name: dependabot-automerge
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+permissions:
+  contents: write
+  pull-requests: write
+concurrency:
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+jobs:
+  automerge:
+    # Dependabot's own PRs in this repo only. This workflow never checks out pull request code: it
+    # reads PR metadata, approves, and turns on auto-merge. Required checks decide whether it merges.
+    if: >-
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.repository == 'opensawce/kaasu'
+    runs-on: ubuntu-latest
+    steps:
+      - id: meta
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      # The issue says /web only. The ecosystem alone is not enough: a future npm entry outside /web
+      # would slip through, so check every changed path instead.
+      - name: Only web dependency bumps
+        id: scope
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          changed=$(gh pr view "$PR" --json files --jq '.files[].path')
+          if [ -z "$changed" ]; then
+            echo "no files changed; leaving it for a human"
+            exit 0
+          fi
+          if printf '%s\n' "$changed" | grep -qv '^web/'; then
+            echo "::notice::changes outside web/; leaving it for a human"
+            exit 0
+          fi
+          echo "ok=true" >> "$GITHUB_OUTPUT"
+      - name: Approve and enable auto-merge
+        if: >-
+          steps.scope.outputs.ok == 'true' &&
+          steps.meta.outputs.package-ecosystem == 'npm_and_yarn' &&
+          steps.meta.outputs.update-type != 'version-update:semver-major'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          if [ "$(gh pr view "$PR" --json reviewDecision --jq .reviewDecision)" != "APPROVED" ]; then
+            gh pr review --approve "$PR"
+          fi
+          if [ -z "$(gh pr view "$PR" --json autoMergeRequest --jq '.autoMergeRequest // empty')" ]; then
+            gh pr merge --auto --squash "$PR"
+          fi
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index f5d4c59..350eba9 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -1,7 +1,7 @@
 name: web
 on:
+  # Runs on every pull request (no path filter) so `web-test` can be a required check on any PR.
   pull_request:
-    paths: ['web/**', '.github/workflows/web.yml']
   push:
     branches: [main]
     paths: ['web/**', '.github/workflows/web.yml']
@@ -12,7 +12,7 @@ concurrency:
   group: web-${{ github.ref }}
   cancel-in-progress: true
 jobs:
-  test:
+  web-test:
     runs-on: ubuntu-latest
     defaults: { run: { working-directory: web } }
     steps:
@@ -24,9 +24,9 @@ jobs:
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: { name: site, path: web/dist, retention-days: 7 }
   deploy:
-    needs: test
-    # Secrets are not available to pull requests from forks.
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    needs: web-test
+    # Secrets are not available to pull requests from forks or to Dependabot.
+    if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1