diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..06a6a080b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# Keeps the GitHub Actions used by .github/workflows up to date.
+# Schema: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    # For this ecosystem '/' means "scan .github/workflows", not the repo root.
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    groups:
+      # Collapse every action bump into one PR per week instead of one per action.
+      github-actions:
+        patterns:
+          - '*'
+    commit-message:
+      # 'chore' prefix so release-please treats bumps as non-releasable.
+      prefix: 'chore(deps)'