diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 62101d072f..940d363c99 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,10 +14,15 @@ updates:
         update-types: ['version-update:semver-minor', 'version-update:semver-patch']
       - dependency-name: '@typescript-eslint/*'
         update-types: ['version-update:semver-minor', 'version-update:semver-patch']
-  # Dependabot only updates hashicorp GHAs, external GHAs are managed by internal tooling (tsccr)
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'daily'
-    allow:
-      - dependency-name: 'hashicorp/*'
+    groups:
+      github-actions-breaking:
+        update-types:
+          - major
+      github-actions-backward-compatible:
+        update-types:
+          - minor
+          - patch