diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9496076..b8851dd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "tuesday"
     cooldown:
       default-days: 7
     groups:
@@ -16,5 +17,6 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "tuesday"
     # Security updates only; routine lock refreshes run in .github/workflows/lock-update.yml
     open-pull-requests-limit: 0
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..8e9adcd
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,28 @@
+# .github/workflows/dependabot-auto-merge.yml
+name: Dependabot auto-merge
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve and enable auto-merge for patch and minor updates
+        if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
diff --git a/.github/workflows/lock-update.yml b/.github/workflows/lock-update.yml
index 9d92b72..f2679d8 100644
--- a/.github/workflows/lock-update.yml
+++ b/.github/workflows/lock-update.yml
@@ -3,10 +3,11 @@ name: Lock update
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 6 * * 2'  # Every Tuesday at 6am UTC
+    - cron: '0 6 * * 1'  # Every Monday at 6am UTC
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 jobs:
   lock-update:
@@ -22,3 +23,4 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          auto-merge: "true"
diff --git a/.github/workflows/pre-commit-autoupdate.yml b/.github/workflows/pre-commit-autoupdate.yml
index 22eff5c..c5fac8c 100644
--- a/.github/workflows/pre-commit-autoupdate.yml
+++ b/.github/workflows/pre-commit-autoupdate.yml
@@ -4,10 +4,11 @@ name: Pre-commit autoupdate
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 9 * * 1'  # Every Monday at 9am
+    - cron: '0 9 * * 3'  # Every Wednesday at 9am
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 jobs:
   autoupdate:
@@ -22,3 +23,4 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          auto-merge: "true"