Dependabot update jobs can now run on GitHub Actions and self-hosted runners
GitHub has announced the general availability of running Dependabot update jobs as GitHub Actions workflows. Administrators on Github.com can now enable this for their repositories or organizations, using either GitHub-hosted or self-hosted runners. Running Dependabot still does not count toward GitHub Actions minutes, so the service remains free.
Previously, Dependabot relied on its own hosted compute, which limited its ability to reach on-premises resources such as private registries. That constraint became more significant as practices like the S2C2F framework increasingly require access to such internal infrastructure. Users also expressed a desire to see all job logs in a single place, rather than having Dependabot activity appear separately from other CI/CD jobs.
By consolidating onto GitHub Actions, Dependabot now inherits that platform’s infrastructure. The key improvement is support for self-hosted runners, which lets update jobs run inside a private network and reach on-premises package registries. This enables Dependabot to update packages that were previously out of reach. The move also brings faster runs, better log visibility, and integration with existing GitHub Actions APIs and webhooks, so failed runs can be detected and fed into downstream CI/CD processing.
Rollout and migration timeline
Over the next year, GitHub will migrate all Dependabot update jobs to run on GitHub Actions. For most users, this transition should be seamless. However, organizations that have disabled GitHub Actions via enterprise policy will need to update their configuration to avoid interrupting the Dependabot service. GitHub says administrators will receive instructions on how to adjust their settings.
Documentation for enabling Dependabot on GitHub Actions runners is available, as is guidance on the differences between hosted and self-hosted runners.
Looking ahead, GitHub is working on support for additional dependabot.yml configuration options covering multiple directories and multiple ecosystems. The team is also collecting feedback on the new compute infrastructure through its community discussion channels.
