diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a6586ff..cbcbe9f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,16 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    ignore:
+      # @types/node must track the runtime Node major, not the latest release.
+      # This is a pure CDK app (no Lambdas); it is built/synthed on Node 24, so
+      # @types/node is pinned to ^24. Dependabot can't see the build Node and a
+      # too-new types major still compiles, so a major bump passes CI while being
+      # wrong. This is the sanctioned exception to the no-blanket-ignore rule
+      # (engineering-handbook github-standards Pinning Principle). Bump deliberately
+      # alongside a Node upgrade. Minor/patch within the current major still flow.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule: