diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e0221c3..fa16814 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,13 @@ updates:
     groups:
       operator-go:
         patterns: ["*"]
+        update-types:
+          - patch
+    ignore:
+      - dependency-name: "k8s.io/*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      - dependency-name: "sigs.k8s.io/controller-runtime"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
 
   - package-ecosystem: npm
     directory: /management-gui/frontend
@@ -26,6 +33,9 @@ updates:
     groups:
       management-frontend:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: npm
     directory: /libs/baggage-node
@@ -34,6 +44,9 @@ updates:
     groups:
       baggage-node:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: pip
     directory: /orchestrator
@@ -42,6 +55,9 @@ updates:
     groups:
       orchestrator-python:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: pip
     directory: /management-gui/backend
@@ -50,6 +66,9 @@ updates:
     groups:
       management-backend-python:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: pip
     directory: /libs/tekton-dag-common
@@ -58,6 +77,9 @@ updates:
     groups:
       common-python:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: pip
     directory: /libs/baggage-python
@@ -66,6 +88,9 @@ updates:
     groups:
       baggage-python:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: maven
     directory: /libs/baggage-spring-boot-starter
@@ -74,6 +99,9 @@ updates:
     groups:
       baggage-spring:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: maven
     directory: /libs/baggage-servlet-filter
@@ -82,6 +110,9 @@ updates:
     groups:
       baggage-servlet:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: composer
     directory: /libs/baggage-php
@@ -90,3 +121,6 @@ updates:
     groups:
       baggage-php:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..768dd89
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,47 @@
+name: dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: dependency-review-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Runtime dependency review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Reject new high-risk runtime dependencies
+        id: review
+        continue-on-error: true
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime,unknown
+          license-check: false
+          show-patched-versions: true
+
+      - name: Skip when Dependency graph is unavailable
+        if: steps.review.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set +e
+          gh api \
+            "repos/${GITHUB_REPOSITORY}/dependency-graph/compare/${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}" \
+            >/tmp/dep-graph.json
+          code=$?
+          set -e
+          if [ "$code" -eq 0 ]; then
+            echo "Dependency graph is available; dependency-review findings must be fixed."
+            exit 1
+          fi
+          echo "Dependency graph is not enabled on this repository; skipping review."
diff --git a/libs/tekton-dag-common/tests/test_ci_all_green.py b/libs/tekton-dag-common/tests/test_ci_all_green.py
new file mode 100644
index 0000000..6db9c39
--- /dev/null
+++ b/libs/tekton-dag-common/tests/test_ci_all_green.py
@@ -0,0 +1,29 @@
+"""Guards that remaining default-branch CI stays closable to green."""
+
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+def test_dependabot_groups_reject_breaking_majors():
+    config = yaml.safe_load((ROOT / ".github/dependabot.yml").read_text())
+    for entry in config["updates"]:
+        groups = entry.get("groups") or {}
+        assert groups, f"{entry['package-ecosystem']} must group updates"
+        for name, group in groups.items():
+            types = set(group.get("update-types") or [])
+            assert "major" not in types, f"{name} must not auto-open majors"
+            assert types <= {"minor", "patch"}
+            if entry["package-ecosystem"] == "gomod":
+                assert types == {"patch"}
+
+
+def test_dependency_review_skips_when_graph_unavailable():
+    workflow = (ROOT / ".github/workflows/dependency-review.yml").read_text()
+
+    assert "actions/dependency-review-action@" in workflow
+    assert "continue-on-error: true" in workflow
+    assert "dependency-graph/compare/" in workflow
+    assert "skipping review" in workflow