diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..57312c0f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      production:
+        dependency-type: production
+      development:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ad21c9e4..45dadfb4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,5 +1,14 @@
+strictDepBuilds: true
+blockExoticSubdeps: true
+trustPolicy: no-downgrade
 minimumReleaseAge: 1440
 
+onlyBuiltDependencies:
+  - core-js
+  - es5-ext
+  - esbuild
+  - protobufjs
+
 minimumReleaseAgeExclude:
   - accounts
   - mppx