diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 98e44ee..24ba14f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/crates/hinzu-rustc-driver"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/adapters/typescript"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/housekeeping.yml b/.github/workflows/housekeeping.yml
index e75764c..65e52c7 100644
--- a/.github/workflows/housekeeping.yml
+++ b/.github/workflows/housekeeping.yml
@@ -13,4 +13,4 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: zmaril/housekeeping@v0.19.0
+      - uses: zmaril/housekeeping@v0.21.0
diff --git a/.housekeeping.toml b/.housekeeping.toml
index 5d753d2..bf19775 100644
--- a/.housekeeping.toml
+++ b/.housekeeping.toml
@@ -5,3 +5,14 @@ fleet = "zmaril/powderworks"
 website = "off"
 # Adopted on enrollment; the fleet default is "recommended".
 conventional-commits = "required"
+
+[allow-auto-merge]
+# Auto-merge is enabled on the repo so a green PR can land without a babysitter.
+# The check asserts GitHub's allow_auto_merge matches this declaration.
+enabled = true
+
+[lockfiles]
+# The typescript adapter deliberately gitignores package-lock.json (.gitignore
+# line 26) — rust is the product and the adapter is a thin binding, so its
+# lockfile isn't tracked. Exempt it rather than reverse that decision.
+ignore = ["adapters/typescript"]