diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ccddc2..6a8d9a7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,8 @@ updates:
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    # Prefer feature → development → main; Dependabot otherwise targets default (main).
+    target-branch: development
     ignore:
       # bincode 3.0.0 is an intentional unmaintained stub that only fails to compile.
       - dependency-name: bincode
@@ -16,11 +18,15 @@ updates:
           - "tonic-*"
           - "prost"
           - "prost-*"
+      sp1:
+        patterns:
+          - "sp1-*"
   - package-ecosystem: cargo
     directory: /clients/rust
     schedule:
       interval: monthly
     open-pull-requests-limit: 3
+    target-branch: development
     groups:
       tonic-prost:
         patterns:
@@ -32,3 +38,4 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    target-branch: development
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 53410c9..382c5be 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -72,12 +72,16 @@ Do not run real CPU `SP1_PROVER=cpu --prove-one` on ≤16 GiB machines without
 
 ## Pull requests
 
-1. Branch from `main` (or the active integration branch agreed with maintainers).
+Flow: **feature → `development` → `main`**. Open product PRs against `development`, not `main`.
+
+1. Branch from `development`.
 2. Ensure mock CI paths pass locally when touching receipts, guests, or gRPC.
 3. If you change the Lean SP1 guest or runtime patches, run `bash scripts/sp1_execute_ci.sh` locally (and refresh `artifacts/sp1_guest_digests.json` from Linux if digests change). Automatic `sp1-execute` CI is off for now — GH runners lack the compute.
 4. Describe **why** in the PR body; link issues if any.
 5. Do not commit secrets, `.env` files, `host/target/`, `.cache/`, or editor junk (e.g. `.#`).
 
+Dependabot PRs target **`development`** (see [`.github/dependabot.yml`](.github/dependabot.yml)). That `target-branch` must stay on the default branch (`main`) or GitHub ignores it.
+
 ## Reporting issues
 
 Use GitHub Issues for bugs and feature requests. For security-sensitive reports, see [SECURITY.md](SECURITY.md).