diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ac4fda6..0a86c6a7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,18 @@ updates:
       day: monday
     open-pull-requests-limit: 5
     ignore:
+      # Build tooling majors are opted into, not queued. These never reach a
+      # user, so the cost of being a release behind is low and the cost of a
+      # surprise is a broken build. Note this also suppresses security PRs for
+      # these, so Dependabot alerts are the backstop.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+      - dependency-name: vitest
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "vite-plugin-*"
+        update-types: ["version-update:semver-major"]
       # 0.8 dropped stateExtensions and updateSchema from the package root and
       # exposes no subpath to reach them, which GrpcEditor needs. Unpin once
       # that editor moves to the jsonSchema helper.