diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 504c6e97..486bdf67 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,31 +1,43 @@
 version: 2
 updates:
-  # Update github actions:
+  # GitHub Actions — one grouped PR/week for all workflow action bumps.
   - package-ecosystem: github-actions
     directory: '/'
     labels: ["A1-insubstantial", "R0-no-crate-publish-required"]
     schedule:
       interval: weekly
+    open-pull-requests-limit: 3
     groups:
       ci_dependencies:
         patterns:
         - "*"
-  # Update Rust dependencies:
+
+  # Rust workspace (root). Collapse the routine churn into TWO grouped PRs a week
+  # (minor/patch together, major together) instead of one PR per crate — otherwise
+  # every unrelated bump opens its own branch and floods the repo (the reason we had
+  # to batch-close a pile of them). Majors stay in their own group so they still get
+  # a deliberate review before merge.
   - package-ecosystem: "cargo"
     directory: "/"
     labels: ["A1-insubstantial", "R0-no-crate-publish-required"]
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 5
     groups:
-      # We assume these crates to be semver abiding and can therefore group them together.
-      known_good_semver:
+      cargo-minor-patch:
+        update-types: ["minor", "patch"]
+      cargo-major:
+        update-types: ["major"]
+
+  # usdt-bridge is a separate crate/workspace with its own Cargo.lock; group its bumps
+  # so the bridge never spawns per-crate PRs of its own (e.g. the stray rand/rustls ones).
+  - package-ecosystem: "cargo"
+    directory: "/tools/usdt-bridge"
+    labels: ["A1-insubstantial"]
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      bridge-deps:
         patterns:
-        - "syn"
-        - "quote"
-        - "log"
-        - "paste"
-        - "*serde*"
-        - "clap"
-        update-types:
-        - "minor"
-        - "patch"
+        - "*"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1b9f5031..5ca82c30 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -33,6 +33,16 @@ variables:
 # ── Workflow: avoid duplicate pipelines ───────────────────────────────────────
 workflow:
   rules:
+    # OPT-IN. This repo is a mirror of github.com/pezkuwichain/pezkuwi-DKS, where the
+    # authoritative full CI already runs on the identical code (github public runners +
+    # self-hosted substrate-build / dks-runner-1). Reproducing that heavy pipeline here
+    # needs self-hosted GitLab runners tagged `pezkuwi-runner` (none are registered on
+    # this namespace) plus CI minutes for the light jobs (the shared-runner quota is
+    # exhausted). Rather than auto-run a pipeline that can never pass, it is gated:
+    # set the CI/CD variable RUN_GITLAB_CI=true (Settings > CI/CD > Variables) once a
+    # `pezkuwi-runner` is registered and minutes are available, then it runs as below.
+    - if: '$RUN_GITLAB_CI != "true"'
+      when: never
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_MERGE_REQUEST_IID
     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/