diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 73f4736..cc6abcd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,11 @@ updates:
   # npm dependencies
   - package-ecosystem: 'npm'
     directory: '/'
+    # Dependency PRs open against dev, not the default branch: main only ever
+    # advances through a release. Dependabot also resets a PR's base to this
+    # value whenever it rebases, so retargeting a single PR by hand does not
+    # survive — the target has to be configured here.
+    target-branch: 'dev'
     schedule:
       interval: 'weekly'
       day: 'monday'
@@ -32,6 +37,7 @@ updates:
   # GitHub Actions
   - package-ecosystem: 'github-actions'
     directory: '/'
+    target-branch: 'dev'
     schedule:
       interval: 'weekly'
       day: 'monday'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 176261e..c71d599 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,12 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
-    branches: [main]
+    # dev is included because dependency and feature PRs target it — without
+    # it those PRs would carry no checks at all, and main would only find out
+    # at release time.
+    branches: [main, dev]
 
 # Cancel in-progress runs for the same PR / branch
 concurrency: