diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 76898e4..60cfae1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -30,6 +30,10 @@ updates:
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    # Synced from prometheus/prometheus; bump them upstream instead.
+    exclude-paths:
+      - ".github/workflows/zizmor.yml"
+      - ".github/workflows/approve-workflows.yml"
     schedule:
       interval: "monthly"
     groups: