diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..ba94cd59d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,75 @@
+version: 2
+updates:
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "java"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    # Groups are keyed at the coherent-project level. Note e.g. org.apache.* is NOT a
+    # single project — org.apache.commons, org.apache.logging.log4j, org.apache.pdfbox,
+    # etc. are unrelated and must not be bundled together, so patterns go three levels deep.
+    groups:
+      aws-sdk:
+        patterns:
+          - "software.amazon.awssdk:*"
+          - "software.amazon.eventstream:*"
+      jetty:
+        patterns:
+          - "org.eclipse.jetty*"
+      jersey:
+        patterns:
+          - "org.glassfish.jersey*"
+          - "org.glassfish.hk2*"
+      jackson:
+        patterns:
+          - "com.fasterxml.jackson*"
+      netty:
+        patterns:
+          - "io.netty*"
+          - "com.typesafe.netty*"
+      log4j:
+        patterns:
+          - "org.apache.logging.log4j*"
+      apache-commons:
+        patterns:
+          - "org.apache.commons:*"
+          - "commons-*:*"
+      test-tooling:
+        patterns:
+          - "org.mockito*"
+          - "net.bytebuddy*"
+          - "org.objenesis:*"
+          - "org.hamcrest:*"
+          - "junit:*"
+      # Catch-all for dependencies not matched by a named group above: bundle only
+      # minor/patch, so a major bump of an *ungrouped* dependency arrives as its own
+      # PR for individual review. (Majors within a named group are NOT split out —
+      # those groups have no update-types restriction, so e.g. a Jackson or Jetty
+      # major rides along in its group PR.)
+      all-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore(docker)"
+    groups:
+      docker-base-images:
+        patterns:
+          - "*"
diff --git a/.github/workflows/dependabot-verification-metadata.yaml b/.github/workflows/dependabot-verification-metadata.yaml
new file mode 100644
index 000000000..000cce61a
--- /dev/null
+++ b/.github/workflows/dependabot-verification-metadata.yaml
@@ -0,0 +1,60 @@
+name: Dependabot Verification Metadata
+
+# Dependabot cannot update gradle/verification-metadata.xml (dependabot/dependabot-core#1996),
+# so every Gradle bump it pushes would otherwise fail CI on stale checksums. This job
+# regenerates the metadata with a cold cache (per CONTRIBUTING.md) on Dependabot's Gradle
+# branches, validates the build in the same run, and commits the refreshed file back to the PR.
+#
+# Triggering on `push` (not `pull_request`) runs in the base-repo context with a writable
+# token; Dependabot's pull_request runs get a read-only token and cannot push.
+
+on:
+  push:
+    branches:
+      - "dependabot/gradle/**"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dependabot-metadata-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          java-package: 'jdk+fx'
+          distribution: 'zulu'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+        with:
+          validate-wrappers: true
+
+      # Cold cache: a warm cache skips re-resolving already-cached parent POMs so they
+      # never get recorded, and the build then fails verification only later in CI.
+      # This step both regenerates the metadata and runs the same build CI runs, so a
+      # green run here proves the bumped artifacts verify and build.
+      - name: Regenerate verification metadata (cold cache)
+        run: |
+          GRADLE_USER_HOME="$(mktemp -d)" ./gradlew --write-verification-metadata sha256 \
+            build dist -PdisableSigning=true -Pcoverage=true
+
+      - name: Commit refreshed metadata
+        run: |
+          if git diff --quiet -- gradle/verification-metadata.xml; then
+            echo "No verification metadata changes to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "Regenerate Gradle dependency verification metadata" \
+            -- gradle/verification-metadata.xml
+          git push origin "HEAD:${GITHUB_REF_NAME}"