diff --git a/.changeset/fix-dependabot-security-config.md b/.changeset/fix-dependabot-security-config.md
new file mode 100644
index 0000000..28d42d3
--- /dev/null
+++ b/.changeset/fix-dependabot-security-config.md
@@ -0,0 +1,12 @@
+---
+'@deessejs/errors': patch
+---
+
+chore(ci): document that `dependabot_security_updates` is now enabled at the repo level.
+
+This PR does not change any user-facing behavior. It adds a header comment to `.github/dependabot.yml` so future contributors and audit readers see why security-update PRs will start flowing without any change to the YAML structure.
+
+The actual setting change (turning on `security_and_analysis.dependabot_security_updates`) was performed at the repo admin level on 2026-10-09 during the bulk dependabot alert cleanup tracked in PRs #101–#104. The legacy PR stream (the `groups` block: weekly minor+patch bumps) is intentionally left unchanged — major bumps remain a manual action.
+
+Release notes:
+- No new `@deessejs/errors` version is needed for this PR — it changes CI configuration only. Patch bump entry on `@deessejs/errors` is included to satisfy the `ci.yml` lint that requires every PR to `staging` to carry a Changeset. The release engineer can drop this entry from the next release batch if preferred.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6220a68..529f041 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,11 @@
 version: 2
+
+# Repository setting `security_and_analysis.dependabot_security_updates` is
+# enabled at the repo level (configured 2026-10-09 during the bulk dependabot
+# alert cleanup tracked in PRs #101-#104). When a CVE with a patched version
+# affects a dependency in this repo, Dependabot will now open a PR
+# automatically. The `groups` block below is for the *version* PR stream
+# (weekly schedule); security updates do not flow through this group.
 updates:
   - package-ecosystem: 'npm'
     directory: '/'