diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 02905917b..4d78ae236 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,28 @@ updates:
       npm-all:
         patterns:
           - "*"
+  # NuGet updates are limited to third-party dependencies and selected test
+  # and tool packages. Other Microsoft-owned packages use dependency flow or
+  # require manual testing.
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    allow:
+      - dependency-name: "Microsoft.AspNetCore.TestHost"
+      - dependency-name: "Microsoft.CodeAnalysis.CSharp.Workspaces"
+      - dependency-name: "Microsoft.NET.Test.Sdk"
+      - dependency-name: "OpenTelemetry.*"
+      - dependency-name: "System.CommandLine"
+      - dependency-name: "xunit"
+      - dependency-name: "xunit.*"
+    groups:
+      nuget-selected:
+        patterns:
+          - "Microsoft.AspNetCore.TestHost"
+          - "Microsoft.CodeAnalysis.CSharp.Workspaces"
+          - "Microsoft.NET.Test.Sdk"
+          - "OpenTelemetry.*"
+          - "System.CommandLine"
+          - "xunit"
+          - "xunit.*"