diff --git a/.agents/skills/docker-and-compose/SKILL.md b/.agents/skills/docker-and-compose/SKILL.md
index 16854ab..48b87c1 100644
--- a/.agents/skills/docker-and-compose/SKILL.md
+++ b/.agents/skills/docker-and-compose/SKILL.md
@@ -44,7 +44,7 @@ Every port published on the developer's machine, by the compose file or by `laun
 
 1. Keep restore before `COPY . .` so a code change doesn't redo the restore layer. A new project folder needs nothing extra; the loops pick up every `src/*/*.csproj` and `tests/*/*.csproj`.
 2. Anything the app writes goes under `/app/data`, the only folder the app user can write to.
-3. Pin every image in compose to a version. Dependabot keeps them current.
+3. Pin every image in compose to a version, and bump them with the monthly package update (`packages-and-dependencies`).
 4. Change base images through the `ARG`s at the top, not inside a `FROM`.
 5. Test locally with `docker compose up -d --build`, then hit `/health/ready` and the API reference.
 
diff --git a/.agents/skills/packages-and-dependencies/SKILL.md b/.agents/skills/packages-and-dependencies/SKILL.md
index 4b2c818..820bff7 100644
--- a/.agents/skills/packages-and-dependencies/SKILL.md
+++ b/.agents/skills/packages-and-dependencies/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: packages-and-dependencies
-description: How NuGet packages are managed with Central Package Management and monthly grouped Dependabot updates, and which packages are not allowed. Use when adding, updating or removing a package.
+description: How NuGet packages are managed with Central Package Management and a monthly update, and which packages are not allowed. Use when adding, updating or removing a package.
 metadata:
   scope: shared
 ---
@@ -9,7 +9,7 @@ metadata:
 
 ## The rule
 
-Versions live in one file, `Directory.Packages.props`, and project files only name the package. Dependabot opens one grouped pull request a month (on the 15th) for NuGet, Docker Compose images and GitHub Actions together. Every package must be free and open source, with no paid or commercial licence tier.
+Versions live in one file, `Directory.Packages.props`, and project files only name the package. Packages are updated once a month, all together in one pull request. If the repository has `.github/dependabot.yml`, Dependabot opens that pull request. If it doesn't, update by hand: `dotnet list package --outdated` lists what's behind. Every package must be free and open source, with no paid or commercial licence tier.
 
 ## Steps
 
@@ -25,7 +25,7 @@ Versions live in one file, `Directory.Packages.props`, and project files only na
 - Put `Version=` on a `PackageReference`.
 - Add MediatR, MassTransit (v9 and later), AutoMapper, FluentAssertions (v8 and later), or any other library that moved to a commercial licence. Use `Mediator`, `Riok.Mapperly` and `Shouldly`.
 - Add a package to quiet a warning or save a few lines.
-- Update one package by hand between Dependabot runs unless it fixes a vulnerability.
+- Update one package on its own between the monthly updates unless it fixes a vulnerability.
 
 ## Check
 
@@ -33,4 +33,5 @@ Versions live in one file, `Directory.Packages.props`, and project files only na
 dotnet restore
 dotnet build
 dotnet list package --vulnerable
+dotnet list package --outdated
 ```