diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index ffa4491a45..4f2272870d 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -1,174 +1,236 @@
 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
-- package-ecosystem: "docker"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "ci"
-  labels: [ "ci", "dependencies" ]
-  open-pull-requests-limit: 10
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "ci"
-  labels: [ "ci", "dependencies" ]
-  open-pull-requests-limit: 10
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "ci"
+    labels: ["ci", "dependencies"]
+    open-pull-requests-limit: 10
 
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "ci"
+    labels: ["ci", "dependencies"]
+    open-pull-requests-limit: 10
 
-# Constrain Kubernetes dependencies to compatibility with default branch - v1.33-v1.35
-- package-ecosystem: "gomod"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies" ]
-  open-pull-requests-limit: 10
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.35.0"]
-- package-ecosystem: "gomod"
-  directory: "/azure-ipam"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "azure-ipam" ]
-  open-pull-requests-limit: 10
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.35.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.35.0"]
-- package-ecosystem: "gomod"
-  directory: "/dropgz"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "dropgz" ]
-  open-pull-requests-limit: 10
-- package-ecosystem: "gomod"
-  directory: "/zapai"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies" ]
-  open-pull-requests-limit: 10
+  # =========================
+  # DEFAULT BRANCH (master/main) — STAGED ROLLOUT
+  # =========================
 
+  # Root go.mod (/): grouped minor+patch + allow majors concurrently
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "12:00"  # UTC
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "grouped"]
+    open-pull-requests-limit: 2
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.35.0"]
 
-# Constrain Kubernetes dependencies to compatibility with release/v1.6 branch - v1.30-v1.32
-- package-ecosystem: "gomod"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "release/1.6"  ]
-  open-pull-requests-limit: 10
-  target-branch: "release/v1.6"
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.32.0"]
-- package-ecosystem: "gomod"
-  directory: "/azure-ipam"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "azure-ipam", "release/1.6" ]
-  open-pull-requests-limit: 10
-  target-branch: "release/v1.6"
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.32.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.32.0"]
+  # /azure-ipam: grouped minor+patch + allow majors concurrently
+  - package-ecosystem: "gomod"
+    directory: "/azure-ipam"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "12:00"  # UTC
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "azure-ipam", "grouped"]
+    open-pull-requests-limit: 2
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.35.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.35.0"]
 
+  # /dropgz: grouped minor+patch + allow majors concurrently
+  - package-ecosystem: "gomod"
+    directory: "/dropgz"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "12:00"  # UTC
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "dropgz", "grouped"]
+    open-pull-requests-limit: 2
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
-# Constrain Kubernetes dependencies to compatibility with release/v1.5 branch - v1.28-v1.30
-- package-ecosystem: "gomod"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "release/1.5" ]
-  open-pull-requests-limit: 10
-  target-branch: "release/v1.5"
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.30.0"]
-- package-ecosystem: "gomod"
-  directory: "/azure-ipam"
-  schedule:
-    interval: "daily"
-  commit-message:
-    prefix: "deps"
-  labels: [ "dependencies", "azure-ipam", "release/1.5" ]
-  open-pull-requests-limit: 10
-  target-branch: "release/v1.5"
-  ignore:
-    - dependency-name: "k8s.io/api"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/apiextensions-apiserver"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/apimachinery"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/client-go"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/kubelet"
-      versions: [">=0.30.0"]
-    - dependency-name: "k8s.io/kubectl"
-      versions: [">=0.30.0"]
+  # /zapai: grouped weekly minor+patch + allow majors concurrently
+  - package-ecosystem: "gomod"
+    directory: "/zapai"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "12:00"  # UTC
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "grouped"]
+    open-pull-requests-limit: 2
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  # =========================
+  # RELEASE BRANCHES — keep daily for v1.5 and v1.6
+  # =========================
+
+  # release/v1.6 constraints (daily);
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "release/1.6"]
+    open-pull-requests-limit: 1
+    target-branch: "release/v1.6"
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.32.0"]
+
+  - package-ecosystem: "gomod"
+    directory: "/azure-ipam"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "azure-ipam", "release/1.6"]
+    open-pull-requests-limit: 1
+    target-branch: "release/v1.6"
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.32.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.32.0"]
+
+  # release/v1.5 constraints (daily)
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "release/1.5"]
+    open-pull-requests-limit: 1
+    target-branch: "release/v1.5"
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.30.0"]
+
+  - package-ecosystem: "gomod"
+    directory: "/azure-ipam"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "deps"
+    labels: ["dependencies", "azure-ipam", "release/1.5"]
+    open-pull-requests-limit: 10
+    target-branch: "release/v1.5"
+    groups:
+      all-go-minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "k8s.io/api"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/apiextensions-apiserver"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/apimachinery"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/client-go"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/kubelet"
+        versions: [">=0.30.0"]
+      - dependency-name: "k8s.io/kubectl"
+        versions: [">=0.30.0"]