diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..03fdf1ed
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,25 @@
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      commit-message:
+          prefix: "build(github-actions)"
+      schedule:
+          interval: "monthly"
+      labels:
+          - "dependabot"
+
+    - package-ecosystem: "composer"
+      directory: "/"
+      commit-message:
+          prefix: "build(dependencies)"
+      schedule:
+          interval: "monthly"
+      labels:
+          - "dependabot"
+      ignore:
+          - dependency-name: "*"
+            update-types: [ "version-update:semver-major" ]
+          - dependency-name: "php"
diff --git a/composer.json b/composer.json
index a29e5225..f24f8961 100644
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
         "ext-json": "*",
         "ext-spl": "*",
         "ducks-project/spl-types": "^1.2",
-        "symfony/polyfill-mbstring": "^1.28",
+        "symfony/polyfill-mbstring": "^1.27",
         "symfony/process": "^4.4",
         "jeroen-g/lighthouse": "^0.2"
     },