diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0fa3bac..3ff966b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -52,6 +52,17 @@ updates:
       # or just remove this ignore and see if Dependabot succeeds) bundles a
       # fixed ip-address, then remove this block.
       - dependency-name: "ip-address"
+      # undici (GHSA, affects the bundled copy) is unreachable, same shape as
+      # ip-address above: nested at node_modules/npm/node_modules/undici@6.27.0,
+      # inside npm's own bundled dependency tree. Verified empirically 2026-08-25
+      # (on node-ninjaone, identical nested path/version -- see
+      # WYRE-AI/node-ninjaone#74) that a package.json overrides pin has zero
+      # effect on this path; only the top-level node_modules/undici moves.
+      # Without this ignore, Dependabot's Security job fails
+      # (security_update_not_possible) with no PR ever opening. The underlying
+      # GHSA alert stays visible on the Security tab regardless. Revisit the
+      # same way as the ip-address entry: remove once npm bundles a fixed undici.
+      - dependency-name: "undici"
       # typescript 7.x breaks this fleet's toolchain: DTS emit (tsup/rollup-plugin-dts
       # TS5101 baseUrl-deprecated-as-error), and typescript-eslint (still <6.1.0 as of
       # 8.66.0, no TS7 support yet). Has broken main 3x on some repos because Dependabot