diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5b9b139..446473e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,10 @@ updates:
       time: "06:00"
       timezone: America/New_York
     open-pull-requests-limit: 5
+    groups:
+      pip-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
 
   - package-ecosystem: github-actions
     directory: /
@@ -17,6 +21,10 @@ updates:
       time: "06:00"
       timezone: America/New_York
     open-pull-requests-limit: 5
+    groups:
+      github-actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
 
   - package-ecosystem: docker
     directory: /
@@ -26,3 +34,7 @@ updates:
       time: "06:00"
       timezone: America/New_York
     open-pull-requests-limit: 5
+    groups:
+      docker-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/docs/SPEC.md b/docs/SPEC.md
index 69b7861..9d3210f 100644
--- a/docs/SPEC.md
+++ b/docs/SPEC.md
@@ -550,7 +550,7 @@ For the server-side stack (Phase K) and any future deployable bits:
       script that checks the deploying user's `.env` against it (refuses
       to start if required vars are missing).
 - [ ] Documented variables: minimum viable set:
-      - `GET_INSTALLER_DB_URL`: Postgres DSN (`postgres://user:pass@host:5432/get`)
+      - `GET_INSTALLER_DB_URL`: Postgres DSN (`postgres://<user>:<password>@host:5432/get`)
       - `GET_INSTALLER_BASE_URL`: public origin (e.g. `https://get.simtabi.com`)
       - `GET_INSTALLER_ALLOWED_ORIGINS`: comma-separated allowlist
       - `GET_INSTALLER_TOKEN_SECRET`: HMAC secret for org tokens