diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 19877dbbeb..8ee450be51 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,26 +1,62 @@
 ---
 version: 2
+
+multi-ecosystem-groups:
+  # Dependencies shipped to downstream rules_python users. We prefer the oldest
+  # compatible version for deployment compatibility, and security fixes here
+  # warrant a rules_python release.
+  user-facing:
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(deps-user)"
+    labels:
+      - "dependencies"
+  # Dependencies used only for rules_python development, tests, CI, and examples.
+  dev-only:
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(deps-dev)"
+    labels:
+      - "dependencies"
+
 updates:
   # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
+    multi-ecosystem-group: "dev-only"
     directories:
       - "/"
       - "/.github/actions/setup-bazel"
-    schedule:
-      interval: "weekly"
+    patterns:
+      - "*"
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
+    multi-ecosystem-group: "user-facing"
     directories:
       # Maintain dependencies for our tools
-      - "/tools/publish"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      - "/tools/**/*"
+    patterns:
+      - "*"
+
+  - package-ecosystem: "cargo"
+    multi-ecosystem-group: "dev-only"
+    directories:
+      - "/crates"
+      - "/crates/**/*"
+    patterns:
+      - "*"
 
   - package-ecosystem: "uv"
+    multi-ecosystem-group: "dev-only"
     directories:
       - "/dev"
+      - "/dev/**/*"
+      - "/examples/**/*"
+      - "/gazelle/examples/**/*"
       - "/sphinxdocs/dev"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      - "/tests/**/*"
+    patterns:
+      - "*"