diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d886cf5a4..9cd5344fb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -40,3 +40,23 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      # `.github/workflows/*.lock.yml` are generated by `gh aw compile`, and
+      # `gh-aw-validation.yml` pins that compiler to one version. Dependabot
+      # rewrites the `uses:` pins inside the generated files without rerunning
+      # the compiler, so the validation job's final
+      # `git diff --exit-code -- *.lock.yml` step regenerates them at the pinned
+      # version and always fails. PR #1171 (0.82.14 -> 0.84.2) is the worked
+      # example: `gh-aw Validation` red with the recompile reverting every
+      # bumped pin.
+      #
+      # `github/gh-aw-actions/setup` appears only in those generated files (and
+      # in the SHA assertion inside `gh-aw-validation.yml`), so ignoring it here
+      # costs no coverage on any hand-written workflow.
+      #
+      # To upgrade gh-aw, bump the version in `gh-aw-validation.yml` (extension
+      # install, version assert, and the `actions-lock.json` entry key + SHA),
+      # update `.github/aw/actions-lock.json`, then recompile with
+      # `gh aw compile canonical-pr-remediator focused-coverage-controller`
+      # and commit the regenerated lock files in the same change.
+      - dependency-name: "github/gh-aw-actions/*"