diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 49779a2..8a20756 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,9 +26,10 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "eslint"
         update-types: ["version-update:semver-major"]
-    # Split by semver impact, not by prod/dev. Patches are safe enough to flow
-    # continuously; minors and majors are held for review so the dependency
-    # state is known when a release tag is cut.
+    # Split by semver impact, not by prod/dev. Patches carry their own low-risk
+    # pull request that reviews in a glance; minors and majors are isolated so
+    # the dependency state is known when a release tag is cut. Every bump is
+    # merged by a human, see the note on the cooldown above.
     commit-message:
       prefix: "build"
       prefix-development: "chore"
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
deleted file mode 100644
index 2b7670c..0000000
--- a/.github/workflows/dependabot-automerge.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Dependabot auto-merge
-
-# Patch bumps are merged without human review, but only after two independent
-# gates: the dependabot.yml cooldown means the release is at least 7 days old,
-# and --auto holds the merge until the required "ci" check passes. The "ci" job
-# aggregates quality, test, build, integration and e2e, so nothing slips in on a
-# partial run. Minor and major bumps stay manual by design.
-
-on: pull_request
-
-# Least privilege by default for every job in this workflow.
-permissions:
-  contents: read
-
-concurrency:
-  group: dependabot-automerge-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  automerge:
-    name: Auto-merge patch updates
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    if: github.actor == 'dependabot[bot]'
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v2
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      # A grouped pull request reports the highest bump it contains, so the
-      # npm-patch group only ever resolves to semver-patch here.
-      - name: Enable auto-merge for patch updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        run: gh pr merge --auto --squash "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}