diff --git a/.github/workflows/dependabot-catalog-convergence.yml b/.github/workflows/dependabot-catalog-convergence.yml
index b6c928d..1a2a84b 100644
--- a/.github/workflows/dependabot-catalog-convergence.yml
+++ b/.github/workflows/dependabot-catalog-convergence.yml
@@ -57,7 +57,11 @@ jobs:
             exit 1
           fi
           response="$(gh api --method PUT "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}/update-branch" -f "expected_head_sha=${current_head}" 2>&1)" || {
-            if ! grep -Fq 'already up to date' <<<"$response"; then
+            if grep -Eq 'already up to date|no new commits' <<<"$response"; then
+              # A branch that is already current is success, not failure;
+              # the poll below must not wait on an update that never ran.
+              response="already up to date"
+            else
               printf '%s\n' "$response" >&2
               exit 1
             fi
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b8df0e..d3fd3f0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+- **Fix the dependabot-catalog-convergence update-branch guard.** A bound
+  pull request already current with the base made the API answer
+  `no new commits`, which matched neither the success pattern nor a real
+  error — the job exited before converging the catalog and left
+  dependabot bumps red on `tool-registry`/`catalog`.
+
 ## [0.1.29] - 2026-09-28
 
 - **Publishable re-cut of `0.1.28`.** Tag `0.1.28` was pushed as an unsigned