diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5841a64..e9da268 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,9 +5,16 @@ updates:
     schedule:
       interval: weekly
     groups:
+      # Only minor and patch updates are safe to batch. Grouping majors here
+      # once produced a single PR carrying ten breaking upgrades (tailwindcss 4,
+      # zod 4, typescript 7 and more), which could not be reviewed or landed as
+      # one unit. Majors now arrive as individual PRs.
       npm-dependencies:
         patterns:
           - "*"
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: github-actions
     directory: /
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index a9414aa..88ce3a6 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -33,6 +33,13 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@v5
         id: release
+        with:
+          # GitHub does not start workflow runs for pull requests opened with the
+          # default GITHUB_TOKEN, so the required lint-and-test check never ran on
+          # release PRs and every one of them sat permanently BLOCKED. A PAT makes
+          # the PR look author-created, which starts the checks. Falls back to the
+          # default token so the workflow still runs if the secret is absent.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
 
   publish-npm:
     needs: release-please