diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7167e01..3d65620 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,10 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    ignore:
+      - dependency-name: "commander"
+        update-types:
+          - "version-update:semver-major"
     groups:
       phase-1-safe-updates:
         applies-to: "version-updates"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1877fc6..009d931 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Kept `commander` on the Node 20-compatible major and ignored future Dependabot major bumps until the CLI runtime
+  floor changes.
 - Fixed `summary morning --text` so it prints a human preview/status even when the JSON result is not sendable.
 
 ## [0.6.0] - 2026-06-05
diff --git a/test/cli.test.ts b/test/cli.test.ts
index b3ed2e4..dea9b73 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -8,6 +8,9 @@ const packageJson = JSON.parse(
   readFileSync(new URL('../package.json', import.meta.url), 'utf8')
 ) as {
   version: string;
+  dependencies: {
+    commander: string;
+  };
   engines: {
     node: string;
   };
@@ -117,4 +120,8 @@ describe('cli', () => {
   test('declares a Node 20 engine floor', () => {
     expect(packageJson.engines.node).toBe('>=20.0.0');
   });
+
+  test('keeps Commander on the Node 20-compatible major', () => {
+    expect(packageJson.dependencies.commander).toMatch(/^\^14\./);
+  });
 });