diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2bbf4fc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+updates:
+- package-ecosystem: "pip"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 5
+  ignore:
+  - dependency-name: "*"
+    update-types:
+    - "version-update:semver-major"
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 5
+  ignore:
+  - dependency-name: "*"
+    update-types:
+    - "version-update:semver-major"
diff --git a/.github/workflows/vps_codex_service_ops.yml b/.github/workflows/vps_codex_service_ops.yml
index ed9d4d2..7164372 100644
--- a/.github/workflows/vps_codex_service_ops.yml
+++ b/.github/workflows/vps_codex_service_ops.yml
@@ -20,8 +20,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: vps-codex-service-ops
+  cancel-in-progress: false
+
 jobs:
   vps-codex-service-ops:
+    # Bind to a protected environment when available so deploy/repair-ssh requires approval.
+    environment: codex-vps-ops
     runs-on:
       - self-hosted
       - codex-vps