diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 87ee21e..5c780aa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,14 @@ version: 2
 # or PlanViewer.Ssms.Installer, so any solution-level scan silently skips them.
 # Every project directory is therefore listed explicitly below. If a new .csproj
 # is added anywhere, add its directory here too.
+#
+# target-branch is REQUIRED on every entry here. Without it Dependabot opens PRs
+# against the *default* branch, which is `main` — and in this repo `main` is only
+# ever updated by a dev -> main release merge. Omitting it once already put two
+# dependency bumps directly onto `main`, behind `dev`.
 updates:
   - package-ecosystem: nuget
+    target-branch: dev
     directories:
       - "/src/PlanViewer.App"
       - "/src/PlanViewer.Core"
@@ -75,6 +81,7 @@ updates:
       - dependency-name: "Velopack"
 
   - package-ecosystem: github-actions
+    target-branch: dev
     directory: "/"
     schedule:
       interval: weekly
diff --git a/server/PlanShare/PlanShare.csproj b/server/PlanShare/PlanShare.csproj
index 67530a6..8d30dcd 100644
--- a/server/PlanShare/PlanShare.csproj
+++ b/server/PlanShare/PlanShare.csproj
@@ -10,8 +10,11 @@
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.10" />
     <!-- Direct ref lifts the transitive SQLitePCLRaw above 2.1.11, which bundles a
          SQLite vulnerable to CVE-2025-6965 (GHSA-2m69-gcr7-jv3q). Microsoft.Data.Sqlite
-         still floors at 2.1.11 — remove this once its floor reaches 2.1.12+. -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
+         still floors at 2.1.11, so this ref is what keeps the native library patched;
+         drop it only once that floor moves past 2.1.11 on its own. 3.0.4 bundles
+         SQLite 3.53.3, and Microsoft.Data.Sqlite 10.0.10 works against the 3.x
+         native layer (full CRUD verified). -->
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
 </Project>
diff --git a/src/PlanViewer.App/PlanViewer.App.csproj b/src/PlanViewer.App/PlanViewer.App.csproj
index 16085a6..2d7bbe7 100644
--- a/src/PlanViewer.App/PlanViewer.App.csproj
+++ b/src/PlanViewer.App/PlanViewer.App.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="Avalonia.Fonts.Inter" Version="11.3.18" />
     <PackageReference Include="AvaloniaEdit.TextMate" Version="11.4.1" />
     <PackageReference Include="AvaloniaEdit.TextMate.Grammars" Version="0.10.12.1" />
-    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="2.0.1" />
+    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="3.0.1" />
     <PackageReference Include="ModelContextProtocol" Version="1.4.1" />
     <PackageReference Include="ModelContextProtocol.AspNetCore" Version="1.4.1" />
     <PackageReference Include="TextMateSharp.Grammars" Version="2.0.4" />
diff --git a/src/PlanViewer.Core/PlanViewer.Core.csproj b/src/PlanViewer.Core/PlanViewer.Core.csproj
index 33f5ff5..c754e67 100644
--- a/src/PlanViewer.Core/PlanViewer.Core.csproj
+++ b/src/PlanViewer.Core/PlanViewer.Core.csproj
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Data.SqlClient" Version="7.0.2" />
-    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="2.0.1" />
+    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="3.0.1" />
     <PackageReference Include="Microsoft.Data.SqlClient.Extensions.Azure" Version="7.0.2" />
     <PackageReference Include="Microsoft.SqlServer.TransactSql.ScriptDom" Version="180.59.2" />
   </ItemGroup>