diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5f06744..d0bb828 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,15 +10,7 @@ updates:
     #   github-actions:
     #     patterns:
     #       - "*"
-  - package-ecosystem: "julia"
-    directories:
-      - "/"
-      - "/docs"
-      - "/test"
-    schedule:
-      interval: "weekly"
-    # To group all Julia dependency updates into a single PR, uncomment the following:
-    # groups:
-    #   julia-dependencies:
-    #     patterns:
-    #       - "*"
+  # Julia dependency updates are handled by CompatHelper
+  # (.github/workflows/CompatHelper.yml) — the registry-aware Julia-ecosystem
+  # standard — so a "julia" package-ecosystem is intentionally NOT declared here
+  # to avoid duplicate PRs. Do not re-add one.
diff --git a/.github/workflows/CompatHelper.yml b/.github/workflows/CompatHelper.yml
index 2eaa139..bd79fbc 100644
--- a/.github/workflows/CompatHelper.yml
+++ b/.github/workflows/CompatHelper.yml
@@ -3,6 +3,14 @@ on:
   schedule:
     - cron: 0 0 * * *
   workflow_dispatch:
+# Least-privilege: scope this workflow's GITHUB_TOKEN to exactly what
+# CompatHelper needs (read the repo, open the compat PR) instead of the
+# repo-wide `write` default. PR *creation* is additionally gated by the
+# repo setting "Allow GitHub Actions to create and approve pull requests"
+# (Settings > Actions > General > Workflow permissions), enabled 2026-06-09.
+permissions:
+  contents: write
+  pull-requests: write
 jobs:
   CompatHelper:
     runs-on: ubuntu-latest
diff --git a/Project.toml b/Project.toml
index 767038e..14fe618 100644
--- a/Project.toml
+++ b/Project.toml
@@ -13,7 +13,7 @@ SciMLBase = "0bca4576-84f4-4d90-8ffe-ffa030f20462"
 [compat]
 CommonSolve = "0.2"
 LineSearch = "0.1"
-SciMLBase = "2.53"
+SciMLBase = "2.53, 3"
 julia = "1.10"
 
 [extras]