diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c081fbf
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,35 @@
+version: 2
+
+updates:
+  # Python runtime dependencies pinned in requirements.txt.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: pip
+
+  # Base image in the Dockerfile. The Seafile AppImage is fetched by URL and
+  # checksum, so Dependabot cannot track it; bump SEAFILE_CLI_VERSION and
+  # SEAFILE_CLI_SHA256 by hand.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: docker
+
+  # Actions used by .github/workflows.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: ci
diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md
index a2602c5..9db2392 100644
--- a/IMPROVEMENTS.md
+++ b/IMPROVEMENTS.md
@@ -156,7 +156,10 @@ Acceptance criteria:
   the same manifest digest.
 - [x] Add OCI labels via `docker/metadata-action`.
 - [ ] Add an SBOM, provenance, and image signing.
-- [ ] Add dependency updates for Python, Docker, and GitHub Actions.
+- [x] Add dependency updates for Python, Docker, and GitHub Actions. A weekly
+  Dependabot configuration covers `requirements.txt`, the Dockerfile base
+  image, and the workflow actions. The Seafile AppImage is fetched by URL and
+  checksum, so it still has to be bumped by hand.
 - [ ] Run dependency and image scans on pull requests and on a schedule.
 
 Acceptance criteria: