diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..165af1678d4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,67 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/litellm-ollama-docker-image"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/livekit_agent_sdk"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pip"
+    directory: "/cookbook/anthropic_agent_sdk"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/tests/pass_through_tests"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/tests/proxy_admin_ui_tests/ui_unit_tests"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/ui/litellm-dashboard"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "cargo"
+    directory: "/litellm-rust"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/fork-patches.txt b/.github/fork-patches.txt
index 2b1f95d7989..ada1b7dcdf9 100644
--- a/.github/fork-patches.txt
+++ b/.github/fork-patches.txt
@@ -23,3 +23,5 @@ docker/Dockerfile.non_root            | FROM ghcr\.io/astral-sh/uv:0\.11\.7@sha2
 litellm-rust/crates/python-bridge/src/gil.rs        | py.detach(f)   | pyo3 0.29 removed Python::allow_threads (renamed Python::detach); RUSTSEC-2026-0176/0177 are only patched at pyo3 >=0.29.0, so we can't downgrade below the version that removed the old GIL API. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
 litellm-rust/crates/python-bridge/src/lib.rs        | Python::attach | pyo3 0.29 removed Python::with_gil (renamed Python::attach); same RUSTSEC-2026-0176/0177 constraint as gil.rs above. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
 litellm-rust/crates/ai-gateway/src/python/config.rs | Python::attach | pyo3 0.29 removed Python::with_gil (renamed Python::attach); same RUSTSEC-2026-0176/0177 constraint as gil.rs above. REMOVAL CONDITION: remove when upstream litellm bumps pyo3 to >=0.29 and updates the bridge itself.
+.github/dependabot.yml | package-ecosystem: "uv" | Fork-only dependabot config covering every ecosystem the fork's security sweep scans (uv, pip for cookbook, npm for all 4 lockfile dirs, cargo for litellm-rust); upstream has none. REMOVAL CONDITION: remove/merge if upstream ever ships its own dependabot.yml that a sync would otherwise clobber.
+tests/proxy_admin_ui_tests/ui_unit_tests/package.json | "ws": "8.21.0" | ws override bumped 8.20.1->8.21.0, closing GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments). REMOVAL CONDITION: remove once upstream's own override (if any) is already >=8.21.0.
diff --git a/tests/proxy_admin_ui_tests/ui_unit_tests/package-lock.json b/tests/proxy_admin_ui_tests/ui_unit_tests/package-lock.json
index 549b40558ac..c8a30fc5ff7 100644
--- a/tests/proxy_admin_ui_tests/ui_unit_tests/package-lock.json
+++ b/tests/proxy_admin_ui_tests/ui_unit_tests/package-lock.json
@@ -6998,9 +6998,9 @@
             }
         },
         "node_modules/ws": {
-            "version": "8.20.1",
-            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-            "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+            "version": "8.21.0",
+            "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+            "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
             "dev": true,
             "license": "MIT",
             "engines": {
diff --git a/tests/proxy_admin_ui_tests/ui_unit_tests/package.json b/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
index c3092827509..57e3f939cfb 100644
--- a/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
+++ b/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
@@ -31,7 +31,7 @@
         "@tootallnate/once": "3.0.1",
         "@isaacs/brace-expansion": "5.0.0",
         "@babel/traverse": "7.28.5",
-        "ws": "8.20.1",
+        "ws": "8.21.0",
         "brace-expansion": "5.0.6",
         "braces": "3.0.3",
         "js-yaml": "3.15.0",