diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2ea7cba..0fa3bac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -52,6 +52,14 @@ updates:
       # or just remove this ignore and see if Dependabot succeeds) bundles a
       # fixed ip-address, then remove this block.
       - dependency-name: "ip-address"
+      # typescript 7.x breaks this fleet's toolchain: DTS emit (tsup/rollup-plugin-dts
+      # TS5101 baseUrl-deprecated-as-error), and typescript-eslint (still <6.1.0 as of
+      # 8.66.0, no TS7 support yet). Has broken main 3x on some repos because Dependabot
+      # has no memory of a prior manual revert and just re-proposes the same major again.
+      # Deliberate hold, not a permanent blind -- remove once typescript-eslint + the
+      # tsup/DTS toolchain support TS7.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "github-actions"
     directory: "/"