diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..aed05a3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    open-pull-requests-limit: 25
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "*"
+      actions-major:
+        update-types:
+          - "major"
+        patterns:
+          - "*"
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index a686049..6b154c5 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -1,7 +1,12 @@
 name-template: 'v$RESOLVED_VERSION'
 tag-template: 'v$RESOLVED_VERSION'
+version-template: '$MAJOR.$MINOR'
 commitish: main
 
+# Two-part Major.Minor versioning only (no patch component) — every
+# non-major label bumps $MINOR, so it increments on every release
+# regardless of label instead of silently accumulating in a $PATCH
+# digit that version-template above wouldn't even display.
 version-resolver:
   major:
     labels:
@@ -9,8 +14,6 @@ version-resolver:
   minor:
     labels:
       - 'type: feat'
-  patch:
-    labels:
       - 'type: fix'
       - 'type: docs'
       - 'type: refactor'
@@ -18,7 +21,7 @@ version-resolver:
       - 'type: chore'
       - 'type: ci'
       - 'type: revert'
-  default: patch
+  default: minor
 
 autolabeler:
   - label: 'type: feat'
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..fb7a4f9
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,34 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'LayeredCraft/devops-templates'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Approve PR
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/local-pr-title-check.yml b/.github/workflows/local-pr-title-check.yml
new file mode 100644
index 0000000..ee40d93
--- /dev/null
+++ b/.github/workflows/local-pr-title-check.yml
@@ -0,0 +1,13 @@
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+  statuses: write
+
+jobs:
+  validate:
+    uses: ./.github/workflows/pr-title-check.yml
diff --git a/.github/workflows/local-release-drafter.yml b/.github/workflows/local-release-drafter.yml
new file mode 100644
index 0000000..f3f76e5
--- /dev/null
+++ b/.github/workflows/local-release-drafter.yml
@@ -0,0 +1,20 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  draft:
+    uses: ./.github/workflows/release-drafter.yml
+    with:
+      event_name: ${{ github.event_name }}
+      pr_draft: ${{ github.event.pull_request.draft == true }}
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 642b450..735c314 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   validate:
     runs-on: ubuntu-latest
-    if: github.actor != 'dependabot[bot]'
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
 
     steps:
       - uses: amannn/action-semantic-pull-request@v6