diff --git a/commitlint.config.mjs b/commitlint.config.mjs
index 3e792c4..e43175c 100644
--- a/commitlint.config.mjs
+++ b/commitlint.config.mjs
@@ -3,8 +3,14 @@
  * Enforced locally via lefthook `commit-msg` and on PRs via
  * .github/workflows/commitlint.yml.
  *
- * Allowed types (extend `scope-enum` when new workspace packages land):
+ * Allowed types (extend `scope-enum` when new workspace packages land or
+ * Dependabot starts grouping under a new scope):
  *   feat, fix, chore, docs, refactor, perf, test, build, ci, style, revert, release
+ *
+ * Bot scopes: Dependabot uses `deps` for production-dep bumps,
+ * `deps-dev` for devDependency-only bumps, and `github_actions` for
+ * GitHub Actions bumps. All three are enumerated so the auto-generated
+ * PRs pass commitlint without manual rewrites.
  */
 export default {
   extends: ["@commitlint/config-conventional"],
@@ -50,6 +56,12 @@ export default {
         "wiki",
         "plugin",
         "deps",
+        // Dependabot emits `deps-dev` for devDependency-only updates and
+        // `github_actions` for GitHub Actions bumps. Including both here
+        // lets commitlint pass on the auto-generated PRs without manual
+        // rewrites. See `.github/dependabot.yml` for the group config.
+        "deps-dev",
+        "github_actions",
         "ci",
         "docs",
         "repo",