diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f21a4257..e3ba2844 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,6 +22,15 @@ updates:
     groups:
       minor-and-patch:
         update-types: ["minor", "patch"]
+    ignore:
+      # @types/node must track the runtime Node major, not the latest release.
+      # /ui is the web dashboard deployed on Vercel; pin @types/node to the Node
+      # major Vercel builds/runs it on. Dependabot can't see that and a too-new
+      # types major still compiles (passes CI, wrong at runtime). Sanctioned
+      # exception to the no-blanket-ignore rule (engineering-handbook
+      # github-standards Pinning Principle). Minor/patch within the major flow.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   # Docker — root Dockerfile
   - package-ecosystem: "docker"