diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ba5220..2febb2c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,6 +26,17 @@ updates:
       time: "05:30"
       timezone: America/Chicago
     open-pull-requests-limit: 3
+    groups:
+      # Vite and its plugins are coupled by peer range, so bumped one at a
+      # time they cannot install. @vitejs/plugin-react 6.x requires
+      # vite ^8.0.0 while this project is on vite ^6.3.5, so the lone plugin
+      # bump dies at `npm ci` with ERESOLVE before any code is compiled.
+      # Same shape as the rustcrypto group below: keeping them in one pull
+      # request makes the major bump atomic and installable.
+      vite:
+        patterns:
+          - "vite"
+          - "@vitejs/*"
 
   - package-ecosystem: cargo
     directory: /ui/src-tauri