diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 20654dc..19c94ff 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,8 +3,11 @@ updates:
   # >>> template:base
   - package-ecosystem: github-actions
     directory: /
+    # Monthly: every update run, and every rebase of an open PR, is a billed Actions run
+    # on a private repository. Security updates ignore the schedule.
     schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 3
     cooldown:
       default-days: 7
     commit-message: