diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9ff205b3..2ce702bf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -123,6 +123,27 @@ updates:
       - dependency-name: "@keyv/redis"
         update-types: ["version-update:semver-major"]
 
+      # keyv has to move with cache-manager, @keyv/redis and the redis plugin,
+      # not ahead of them. Both providers hand their Keyv stores to
+      # cache-manager's createCache, and cache-manager 7.2.9 (the latest) still
+      # depends on keyv ^5.6. Bumped alone to 6.1.0, keyv broke every redis
+      # purge (#234): it has no `opts` at all, so the provider's
+      # `cache.stores[0].opts.store` threw "Cannot read properties of undefined
+      # (reading 'store')".
+      #
+      # Fixing that accessor is not the port. keyv 6 wraps @keyv/redis 3 in a
+      # bridge adapter and no longer defaults the "keyv" namespace, so the
+      # SMEMBERS enumeration (#131) and cluster-safe delete (#100) would be
+      # skipped and purges would quietly match `undefined:*` instead of
+      # failing. Port it deliberately once cache-manager supports keyv 6.
+      #
+      # This does not hold up the move to node-redis: @keyv/redis 4 and 5
+      # already use @redis/client and still peer on keyv ^5, so that migration
+      # (#239, with the plugin-redis v3 rewrite) can land on keyv 5. Only
+      # @keyv/redis 6 needs keyv 6.
+      - dependency-name: "keyv"
+        update-types: ["version-update:semver-major"]
+
       # react-intl is governed by the admin runtime, not by us. The plugin peers
       # on ^6.0.0 and @strapi/admin bundles 6.6.2, so a major only produces an
       # unmergeable PR - the same situation as react and react-router-dom above.
@@ -134,6 +155,16 @@ updates:
       - dependency-name: "jest-cli"
         update-types: ["version-update:semver-major"]
 
+      # mermaid 12 makes ELK and a new look the defaults, and renders our
+      # flowchart labels with their second line clipped ("GET on a cached
+      # route" becomes "GET on a cached"); `look: 'classic'` restores most of
+      # it but still clips. vitepress-plugin-mermaid also only declares
+      # support for mermaid 10 || 11. Nothing in CI renders the docs, so this
+      # can only be checked by eye in a browser. Revisit when the plugin
+      # supports 12.
+      - dependency-name: "mermaid"
+        update-types: ["version-update:semver-major"]
+
   - package-ecosystem: github-actions
     directory: /
     schedule: