diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index faa92cde..38646894 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -54,3 +54,20 @@ updates:
         update-types:
           - minor
           - patch
+    # `imbl` is a direct dependency (src-tauri/Cargo.toml) only so our code can
+    # share `imbl::Vector`/`Arc<TimelineItem>` types with what matrix-sdk-ui
+    # 0.18.0 returns from its timeline API — see the comment there. A *major*
+    # bump breaks that: matrix-sdk-ui's own `imbl = "6.1.0"` requirement can't
+    # follow it, so two semver-incompatible `imbl` versions end up in the
+    # dependency graph, which Cargo treats as distinct types even though the
+    # crate name matches — breaking every call site that passes a
+    # matrix-sdk-ui Vector into our code (first seen in PR #42,
+    # dependabot/cargo/src-tauri/main/cargo-major-12407c90ff: E0308 "multiple
+    # different versions of crate `imbl`"). A 6.x minor/patch release is fine
+    # — matrix-sdk-ui's requirement still resolves to it — so only major
+    # updates are ignored here; remove this ignore in the same PR that bumps
+    # matrix-sdk/matrix-sdk-ui past their current imbl requirement.
+    ignore:
+      - dependency-name: "imbl"
+        update-types:
+          - "version-update:semver-major"
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index be6a5be8..9473f86a 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -45,6 +45,14 @@ tauri-plugin-dialog = "2.7.1"
 tauri-plugin-store = "2"
 matrix-sdk-ui = "0.18.0"
 lru = "0.12"
+# Direct dep so timeline.rs can pass matrix-sdk-ui's returned
+# `imbl::Vector<Arc<TimelineItem>>` straight into our own functions — Cargo
+# treats two semver-incompatible `imbl` versions as distinct types even with
+# the same crate name, so stay on imbl 6.x until matrix-sdk-ui (currently
+# pinned to `imbl = "6.1.0"` itself) moves past 6.x — don't jump to the
+# latest imbl release independently. Bumping the major version breaks that
+# type match (see PR #42); dependabot is configured to ignore major-version
+# imbl bumps (.github/dependabot.yml) until matrix-sdk-ui moves.
 imbl = "6.1.0"
 regex = "1"
 async-trait = "0.1"