diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 78bb66561c..1b2e412960 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -53,3 +53,10 @@ updates:
     - "/.github/actions/*"
   schedule:
     interval: weekly
+  # Dependabot treats each subpath of an action repo as a separate dependency, so
+  # ungrouped it bumps e.g. codeql-action/init without codeql-action/analyze.
+  # Grouping ensures all actions are upgraded together, in a single PR.
+  groups:
+    github-actions:
+      patterns:
+        - "*"