diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 0e36666e..3f6b2fea 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -21,6 +21,10 @@ permissions:
 
 jobs:
   scan:
+    # Skip on Dependabot PRs: a cross-repo reusable workflow called with `secrets: inherit`
+    # startup-fails for Dependabot's restricted context, which blocks Dependabot's own security
+    # PRs. Dependabot already vetted the bump; push/schedule still scan the default branch.
+    if: ${{ github.actor != 'dependabot[bot]' }}
     uses: resq-software/.github/.github/workflows/security-scan.yml@73b9edb8f4f28a99f70ee22eb5e2dd2bf7807c84 # main
     with:
       languages: '["actions"]'