diff --git a/.github/actions/tend-setup/action.yaml b/.github/actions/tend-setup/action.yaml
index 52dd9637ef60..13d8aec47d53 100644
--- a/.github/actions/tend-setup/action.yaml
+++ b/.github/actions/tend-setup/action.yaml
@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Setup Task
-      uses: go-task/setup-task@v1
+      uses: go-task/setup-task@v2
       with:
         repo-token: ${{ inputs.github-token }}
         version: 3.52.0
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index c7f8a6b4a72a..0b05d7aadf79 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -39,11 +39,16 @@ updates:
     labels: []
 
   - package-ecosystem: "github-actions"
+    # `/` only covers `.github/workflows/`; each composite action under
+    # `.github/actions/` needs its own entry or its `uses:` refs are never
+    # scanned. Keep this list in sync with `ls .github/actions/`.
     directories:
       - "/"
-      - ".github/actions/build-python"
+      - ".github/actions/build-js"
       - ".github/actions/build-prqlc"
       - ".github/actions/build-prqlc-c"
+      - ".github/actions/build-python"
+      - ".github/actions/tend-setup"
       - ".github/actions/time-compilation"
     commit-message:
       prefix: "chore: "