diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 8b77372e00..ba0c8f1b58 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -44,7 +44,10 @@ updates:
     cooldown:
       default-days: 3
     groups:
+      codeql-action:
+        patterns: ["github/codeql-action*"]
       actions-patch:
+        exclude-patterns: ["github/codeql-action*"]
         update-types: ["patch"]
 
   # npm (Docusaurus site)
@@ -82,13 +85,21 @@ updates:
     cooldown:
       default-days: 7
       semver-major-days: 30
+    ignore:
+      # hive/statedb/stream versions are pinned by cilium/cilium's go.mod;
+      # they can only move when cilium/cilium moves.
+      - dependency-name: "github.com/cilium/hive"
+      - dependency-name: "github.com/cilium/statedb"
+      - dependency-name: "github.com/cilium/stream"
     groups:
       k8s:
         patterns:
           - "k8s.io/*"
           - "sigs.k8s.io/*"
+          - "helm.sh/helm/v3"
+          - "sigs.k8s.io/cloud-provider-azure/pkg/azclient/configloader"
         exclude-patterns:
-          - "sigs.k8s.io/cloud-provider-azure/*"
+          - "sigs.k8s.io/cloud-provider-azure/pkg/azclient"
         update-types: ["patch", "minor"]
       cilium:
         patterns:
@@ -106,4 +117,4 @@ updates:
       otel:
         patterns:
           - "go.opentelemetry.io/*"
-        update-types: ["patch"]
+        update-types: ["patch", "minor"]