diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1c34cf3fd5..ee25085bdb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,6 +24,14 @@ updates:
     ignore:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
+      # Nx is upgraded exclusively via `yarn nx migrate`, which keeps the whole `nx`/`@nx/*` set
+      # version-locked and applies config codemods (nx.json, project.json, migrations.json).
+      # A Dependabot bump only touches package.json/yarn.lock, so it silently skips the codemods
+      # and can desync plugin versions from the Nx runtime. Banned outright, security updates
+      # included — those must go through `nx migrate` too.
+      - dependency-name: 'nx'
+      - dependency-name: '@nx/*'
+      - dependency-name: '@nrwl/*'
     groups:
       production-dependencies:
         dependency-type: 'production'