diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3b3700c..bb9405b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,10 +6,15 @@ updates:
     schedule:
       interval: "weekly"
 
-  # Dependabot only updates HashiCorp GHAs, external GHAs are managed by internal tooling (tsccr)
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
-    allow:
-      - dependency-name: "hashicorp/*"
+    groups:
+      github-actions-breaking:
+        update-types:
+          - major
+      github-actions-backward-compatible:
+        update-types:
+          - minor
+          - patch