diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index b0b47c7..de33f5e 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -45,8 +45,9 @@ jobs:
           ALERT_STATE: ${{ steps.meta.outputs.alert-state }}
         run: |
           set -euo pipefail
-          # Release/review tooling stays manual even when patch/minor.
-          deny='googleapis/release-please-action dependabot/fetch-metadata jdx/jactionlint github/codeql-action zizmorcore/zizmor-action actions/dependency-review-action trufflesecurity/trufflehog sigstore/cosign-installer anchore/sbom-action contributor-assistant/github-action'
+          # Only the release driver and this gate stay manual: a broken bump there
+          # can change how every release is produced or how eligibility is decided.
+          deny='googleapis/release-please-action dependabot/fetch-metadata'
           dep_names="${DEP_NAMES// /}"
           for blocked in $deny; do
             case ",${dep_names}," in
@@ -71,30 +72,29 @@ jobs:
           reason=""
 
           # Eligible non-major security updates bypass cooldown.
-          if { [ "$alert" = "OPEN" ] || [ "$alert" = "FIXED" ]; }; then
+          if [ "$alert" = "OPEN" ] || [ "$alert" = "FIXED" ]; then
             eligible=true
             reason="security-update"
           fi
 
-          # Patch updates after cooldown window.
+          # Patch updates after the cooldown window.
           if [ "$ut" = "version-update:semver-patch" ]; then
             eligible=true
             reason="semver-patch"
           fi
 
-          # Only explicitly classified patch/minor Action updates are eligible.
+          # github-actions minor bumps (covers SHA pin bumps).
           if [ "$eco" = "github-actions" ] || [ "$eco" = "github_actions" ]; then
-            if [ "$ut" = "version-update:semver-patch" ] || [ "$ut" = "version-update:semver-minor" ]; then
+            if [ "$ut" = "version-update:semver-minor" ]; then
               eligible=true
               reason="github-actions-non-major"
             fi
           fi
 
-          # Minor of non-production / indirect / development deps.
-          # Production minors stay manual (primary npm supply-chain surface).
+          # Minor bumps of indirect or development dependencies.
           if [ "$ut" = "version-update:semver-minor" ] && [ "$dt" != "direct:production" ]; then
             eligible=true
-            reason="minor-non-production"
+            reason="${reason:-indirect-or-dev-minor}"
           fi
 
           if [ "$eligible" != true ]; then
@@ -102,5 +102,12 @@ jobs:
             exit 0
           fi
 
+          # Required-review rules cannot be satisfied by the bot unless the
+          # repository allows Actions to approve. Approving here keeps human PRs
+          # behind review while letting an eligible dependency bump merge itself.
+          if gh pr view "$PR_URL" --json reviewDecision --jq '.reviewDecision' | grep -q REVIEW_REQUIRED; then
+            gh pr review "$PR_URL" --approve --body "Automated approval: classified $reason update; CI still gates the merge."
+          fi
+
           echo "enable auto-merge ($reason): ecosystem=$eco update-type=$ut dependency-type=$dt alert=$alert names=$DEP_NAMES"
           gh pr merge --auto --squash "$PR_URL"