diff --git a/.ai/decisions.yaml b/.ai/decisions.yaml
index 3867ad60..4a5b3a53 100644
--- a/.ai/decisions.yaml
+++ b/.ai/decisions.yaml
@@ -124,6 +124,42 @@ decisions:
     - .release-it/vscode-version.js
     - package.json (release:main, release:beta scripts)
     title: Release It
+  DEPENDABOT_TARGETS_BETA:
+    date: '2026-09-14'
+    status: accepted
+    context: Dependabot defaulted to the repository default branch (main), which is the stable
+      release line. Bumps opened there duplicated what had already landed on beta, and a merge
+      to main auto-cuts a stable release.
+    decision: 'Set target-branch: "beta" on every ecosystem in .github/dependabot.yml (npm,
+      github-actions, pip)'
+    rationale:
+    - A push to main runs release-it with .release-it.json and cuts a stable GitHub release, so
+      a routine dependency bump merged there ships a release out of band
+    - main trails beta by everything not yet released, so bumps against main duplicate versions
+      beta already carries (e.g. #291/#292/#295 re-proposed bumps merged weeks earlier)
+    - Retargeting such a PR to beta conflicts on package-lock.json, since beta has moved
+    - Updates reach main the same way every other change does, through the beta -> main release PR
+    implementation:
+      config: '.github/dependabot.yml, target-branch: "beta" on each of the three package-ecosystem
+        entries'
+      flow: dependabot -> beta -> release PR -> main
+    alternatives_considered:
+    - name: leave_targeting_main
+      rejected_because: Ships stable releases from dependency bumps and produces duplicate PRs
+    - name: retarget_each_pr_by_hand
+      rejected_because: Lockfile conflicts on every npm PR; recurring manual work
+    consequences:
+      positive:
+      - Dependency updates follow the same path as feature work
+      - No stable release cut by a dependency bump
+      - No duplicate bumps against a stale branch
+      negative:
+      - A security fix reaches main only when the next release PR merges
+    references:
+    - .github/dependabot.yml
+    - .release-it.json
+    - .release-it.beta.json
+    title: Dependabot Targets Beta
   MODULAR_SERVICE_SPLIT:
     date: '2026'
     status: accepted
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a8ce834..e83bba37 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,11 +6,18 @@
 # in osv-scanner.toml that the Argus scan honors. Do NOT add a dev-dep `ignore:` here to suppress
 # those alerts -- `ignore:` also stops the version-update PRs below, which are how dev tools stay
 # current and how a transitive fix (e.g. serialize-javascript >= 7.0.5) actually lands.
+#
+# Every ecosystem below sets `target-branch: "beta"`. Without it Dependabot opens against the default
+# branch (`main`), which is the STABLE release line: a push there auto-cuts a stable GitHub release, so a
+# routine dependency bump would ship one out of band. `main` also trails `beta` by whatever has not been
+# released yet, so bumps opened against it duplicate what already landed on `beta` and conflict on the
+# lockfile when retargeted. Everything reaches `main` through the beta -> main release PR instead.
 version: 2
 updates:
   # Maintain npm dependencies
   - package-ecosystem: "npm"
     directory: "/"
+    target-branch: "beta"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -68,6 +75,7 @@ updates:
   # Maintain GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "beta"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -85,6 +93,7 @@ updates:
   # Maintain pre-commit hooks
   - package-ecosystem: "pip"
     directory: "/"
+    target-branch: "beta"
     schedule:
       interval: "weekly"
       day: "monday"
diff --git a/.github/workflows/security-hardening.yml b/.github/workflows/security-hardening.yml
index 6ea3a05b..6c4ecfcb 100644
--- a/.github/workflows/security-hardening.yml
+++ b/.github/workflows/security-hardening.yml
@@ -19,7 +19,9 @@ permissions:
 jobs:
   argus-hardening:
     name: Argus Reusable Hardening
-    # Pinned to the commit for Argus v1.11.0 for supply-chain safety.
+    # SHA-pinned rather than tag-pinned for supply-chain safety: a tag can be moved, a commit cannot.
+    # Dependabot bumps this SHA and names the tag it resolves to in the PR title, so read the version there
+    # rather than trusting a hand-written one here (this comment claimed v1.11.0 through three bumps past it).
     uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@cc7ef8e7de85340368bf74e7c617e1a8f08ff5bb
     with:
       scanners: codeql,gitleaks,osv,dependency-review