diff --git a/templates/go-app/.github/dependabot.yml b/templates/go-app/.github/dependabot.yml
index 9f5d682..f1dc4cc 100644
--- a/templates/go-app/.github/dependabot.yml
+++ b/templates/go-app/.github/dependabot.yml
@@ -1,3 +1,38 @@
+# Managed by netresearch/.github/templates/go-app/
+#
+# Declares only the ecosystems every go-app consumer is guaranteed to have:
+# gomod, github-actions, and docker (all go-app repos ship a Dockerfile).
+#
+# npm and devcontainers are OPT-IN: a repo that actually has a package.json
+# or a devcontainer adds the block below to its own dependabot.yml and lists
+# `.github/dependabot.yml` under `intentional-drift:` in .github/template.yaml
+# so the template sync stops managing the file. Declaring an ecosystem without
+# its manifest makes the Dependabot run fail with `dependency_file_not_found`.
+#
+# Opt-in npm:
+#   - package-ecosystem: npm
+#     directory: /
+#     schedule:
+#       interval: weekly
+#       day: monday
+#     open-pull-requests-limit: 5
+#     groups:
+#       npm:
+#         patterns: ['*']
+#     cooldown:
+#       default-days: 7
+# Opt-in devcontainers:
+#   - package-ecosystem: devcontainers
+#     directory: /
+#     schedule:
+#       interval: weekly
+#       day: monday
+#     open-pull-requests-limit: 2
+#     groups:
+#       devcontainers:
+#         patterns: ['*']
+#     cooldown:
+#       default-days: 7
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -35,27 +70,3 @@ updates:
         patterns: ['*']
     cooldown:
       default-days: 7
-
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    groups:
-      npm:
-        patterns: ['*']
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: devcontainers
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 2
-    groups:
-      devcontainers:
-        patterns: ['*']
-    cooldown:
-      default-days: 7
diff --git a/templates/go-lib/.github/dependabot.yml b/templates/go-lib/.github/dependabot.yml
index 7e68e9f..36113e8 100644
--- a/templates/go-lib/.github/dependabot.yml
+++ b/templates/go-lib/.github/dependabot.yml
@@ -1,3 +1,25 @@
+# Managed by netresearch/.github/templates/go-lib/
+#
+# Declares only the ecosystems every go-lib consumer is guaranteed to have:
+# gomod and github-actions. Libraries don't ship a Dockerfile, so docker is
+# NOT declared by default — declaring an ecosystem without its manifest makes
+# the Dependabot run fail with `dependency_file_not_found`.
+#
+# docker (or npm/devcontainers) is OPT-IN: a library that genuinely has the
+# manifest adds the block to its own dependabot.yml and lists
+# `.github/dependabot.yml` under `intentional-drift:` in .github/template.yaml
+# so the template sync stops managing the file. Example:
+#   - package-ecosystem: docker
+#     directory: /
+#     schedule:
+#       interval: weekly
+#       day: monday
+#     open-pull-requests-limit: 3
+#     groups:
+#       docker:
+#         patterns: ['*']
+#     cooldown:
+#       default-days: 7
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -23,15 +45,3 @@ updates:
         patterns: ['*']
     cooldown:
       default-days: 7
-
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    groups:
-      docker:
-        patterns: ['*']
-    cooldown:
-      default-days: 7