diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d16bd5c1..23459849 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -30,6 +30,18 @@ updates:
       interval: weekly
     open-pull-requests-limit: 10
     groups:
+      # Keep the CDK CLI and library (plus constructs) in a single PR: they are
+      # version-coupled — aws-cdk-lib's cloud-assembly schema must be readable
+      # by the aws-cdk CLI. NOTE: grouping only batches *version* updates. A
+      # security advisory affecting just one of them can still bump it alone
+      # (Dependabot only touches packages with an update/advisory), so the
+      # "Validate CDK synthesis" CI check remains the real guard against
+      # lib/CLI schema drift.
+      aws-cdk:
+        patterns:
+          - "aws-cdk"
+          - "aws-cdk-lib"
+          - "constructs"
       npm:
         patterns:
           - "*"
diff --git a/.kiro/steering/tech.md b/.kiro/steering/tech.md
index 4a3b4928..e1ae93bc 100644
--- a/.kiro/steering/tech.md
+++ b/.kiro/steering/tech.md
@@ -36,10 +36,32 @@ npx cdk destroy
 ```
 
 ## Dependencies
-- **aws-cdk-lib**: ^2.189.1 - Core CDK library
-- **constructs**: ^10.3.0 - CDK constructs framework
-- **dotenv**: ^16.4.5 - Environment variable management
-- **cdk-nag**: ^2.36.18 - Security and compliance validation
+
+Versions are intentionally **not** listed here — they are tracked in the package
+manifests, which are the single source of truth. See the root `package.json` and
+`package-lock.json` (CDK app) and `website/package.json` (docs site) for the
+current, authoritative versions. This section only names the key dependencies and
+their roles.
+
+Runtime dependencies (CDK app):
+- **aws-cdk-lib** - Core CDK v2 library
+- **constructs** - CDK constructs framework
+- **dotenv** - Environment variable management
+- **source-map-support** - Source maps for stack traces
+
+Build / test toolchain (devDependencies):
+- **aws-cdk** (CLI) - CDK CLI for synth/deploy
+- **typescript** - TypeScript compiler
+- **ts-node** - TypeScript execution for the CDK app entrypoint
+- **cdk-nag** - Security and compliance validation
+- **jest** / **ts-jest** - Unit testing
+- **@types/node** / **@types/jest** - Type definitions
+
+> The `aws-cdk` CLI and `aws-cdk-lib` are version-coupled: the CLI must be new
+> enough to read the cloud-assembly schema emitted by the library, so bump them
+> together (the "Validate CDK synthesis" CI check enforces this). Keep
+> `@types/node`'s major aligned with the Node.js runtime you target rather than
+> chasing its latest release.
 
 ## Development Standards
 - Strict TypeScript configuration with null checks