diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..a7c606ae
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,49 @@
+version: 2
+
+updates:
+  # - package-ecosystem: "gomod"
+  #   open-pull-requests-limit: 5
+  #   cooldown:
+  #     default-days: 7
+  #   # find . -name "go.mod" | xargs -i dirname {}
+  #   directories:
+  #     - "/components/access-management"
+  #     - "/components/poddefaults-webhooks"
+  #     - "/components/profile-controller"
+  #   schedule:
+  #     interval: "daily"
+  #   commit-message:
+  #     prefix: "chore"
+  #   ignore:
+  #     # k8s upgrades are expected to be breaking changes and should be handled
+  #     # manually
+  #     - dependency-name: "k8s.io/*"
+  #       update-types:
+  #         - "version-update:semver-major"
+  #         - "version-update:semver-minor"
+  #     - dependency-name: "sigs.k8s.io/*"
+  #       update-types:
+  #         - "version-update:semver-major"
+  #         - "version-update:semver-minor"
+  #   groups:
+  #     k8s-packages:
+  #       patterns:
+  #         - "k8s.io/*"
+  #         - "sigs.k8s.io/*"
+  #     go-test-packages:
+  #       patterns:
+  #         - "github.com/onsi/*"
+
+  - package-ecosystem: "github-actions"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "chore"
+    groups:
+      docker-actions:
+        patterns:
+          - "docker/*"