diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c77e899..71af762 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,19 @@
 version: 2
 updates:
+  # Security updates reuse this entry only when its directory matches the
+  # manifest's own; they scan requirement/ as "/requirement", so both are listed.
   - package-ecosystem: "pip"
-    directory: "/"
+    directories:
+      - "/"
+      - "/requirement"
     schedule:
       interval: "daily"
+    # Odoo versions kept only as migration sources: their pins stay frozen.
+    # Globs cover requirements, ignore_requirements, pyproject and poetry.lock.
     exclude-paths:
-      - "requirement/requirements.odoo12.0_python3.7.17.txt"
-      - "requirement/requirements.odoo13.0_python3.7.17.txt"
-      - "requirement/requirements.odoo14.0_python3.8.20.txt"
-      - "requirement/requirements.odoo15.0_python3.8.20.txt"
-      - "requirement/requirements.odoo16.0_python3.10.18.txt"
-      - "requirement/requirements.odoo17.0_python3.10.18.txt"
+      - "**/*odoo12.0_*"
+      - "**/*odoo13.0_*"
+      - "**/*odoo14.0_*"
+      - "**/*odoo15.0_*"
+      - "**/*odoo16.0_*"
+      - "**/*odoo17.0_*"