diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5551d15..82eeaf3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,6 +15,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Wait a week after a release before PRing it, so pulled/broken versions
+    # never land here.
+    cooldown:
+      default-days: 7
     groups:
       npm-dependencies:
         patterns:
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..b95fa9d
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,3 @@
+# Ignore versions published less than 7 days ago (10080 minutes), so a pulled
+# or compromised release never gets installed. Mirrors the dependabot cooldown.
+minimum-release-age=10080