diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6fb6d0a..43487a6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,74 +4,141 @@ updates:
     directory: /infra
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      infra:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: npm
     directory: /web
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      web:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: npm
     directory: /mobile
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      mobile-npm:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: bundler
     directory: /mobile
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      mobile-bundler:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: nuget
     directory: /api
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      api:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: pip
     directory: /lambdas/pdf-extract
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      pdf-extract:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: pip
     directory: /lambdas/pdf-generate
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      pdf-generate:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: pip
     directory: /lambdas/library-ingest
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      library-ingest:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: pip
     directory: /lambdas/suggestions
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      suggestions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: pip
     directory: /lambdas/oss-index-creator
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-
+    open-pull-requests-limit: 10
+    groups:
+      oss-index-creator:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/infra/lib/foundation-stack.ts b/infra/lib/foundation-stack.ts
index b2fa4ab..c5bb5ef 100644
--- a/infra/lib/foundation-stack.ts
+++ b/infra/lib/foundation-stack.ts
@@ -88,7 +88,11 @@ export class FoundationStack extends cdk.Stack {
     // PR3: replaced the RDS instance + OpenSearch Serverless with Aurora + pgvector
     // (kills the AOSS OCU floor; scales toward 0 ACU when idle). Data API is required
     // by Bedrock Knowledge Bases to query the vector table.
-    const dbCluster = new rds.DatabaseCluster(this, 'Database', {
+    // Construct ID is 'AuroraCluster' (not 'Database') so CloudFormation gets a NEW
+    // logical ID for the cluster — the old RDS DBInstance shared logical ID 'Database*'
+    // and CFN forbids changing a resource's type in place ("Update of resource type is
+    // not permitted"). A distinct ID makes it a clean replace instead.
+    const dbCluster = new rds.DatabaseCluster(this, 'AuroraCluster', {
       clusterIdentifier: `proposal-system-db${config.stackSuffix}`,
       engine: rds.DatabaseClusterEngine.auroraPostgres({
         version: rds.AuroraPostgresEngineVersion.VER_15_4,