diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 754df1f..e9d82ea 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,6 +20,11 @@ updates:
       default-days: 7
     open-pull-requests-limit: 5
     labels: [dependencies]
+    ignore:
+      # matplotlib 3.11 dropped Python 3.10, which this package still supports; a
+      # feature bump would also rewrite the floor in ci.in. Patch releases still flow.
+      - dependency-name: matplotlib
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
     groups:
       # One PR for the routine patch churn, individual PRs for anything that could
       # change behaviour.
diff --git a/requirements/ci.in b/requirements/ci.in
index 0483129..d4f4cb9 100644
--- a/requirements/ci.in
+++ b/requirements/ci.in
@@ -2,5 +2,6 @@ jsonschema>=4.18,<5
 pyyaml>=6
 pytest>=8
 ruff>=0.6
-matplotlib>=3.8
+# matplotlib 3.11 dropped Python 3.10; lift the ceiling when requires-python does.
+matplotlib>=3.8,<3.11
 markdown>=3.7