diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9994b6a3..3a8bf4bd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,19 +20,23 @@ updates:
     # of them individually. Bumping x509-cert alone puts der 0.8 in the graph
     # beside the der 0.7 that `cms 0.2` pins, and the two do not interoperate:
     # `AlgorithmIdentifier<x509_cert::der::Any>` stops satisfying `der::DerOrd`.
-    # const-oid 0.10 fails on its own for the same reason.
+    # const-oid 0.10 and `der` itself fail on their own for the same reason: a
+    # lone `der` 0.8 leaves `cms 0.2`'s types and `dpp-seal`'s on different
+    # `der`s, and the seal path stops compiling.
     #
-    # The only `cms` built on that train is 0.3.0-pre.2, which rides
-    # der 0.8.0-rc.10, x509-cert 0.3.0-rc.4 and rsa 0.10.0-rc.14. Release
-    # candidates do not belong under the eIDAS seal path, and `cms` is pinned
-    # `default-features = false` precisely to keep rsa and RUSTSEC-2023-0071
-    # out of the tree — an avoidance that would have to be re-derived against
-    # an rsa RC.
+    # Everything on that train is stable except `cms`. Its only 0.3 builds are
+    # pre-releases, and the newest (0.3.0-rc.0) rides stable der 0.8,
+    # x509-cert 0.3, spki 0.8 and const-oid 0.10, with an optional `rsa` on
+    # 0.10.0-rc.19. Release candidates do not belong under the eIDAS seal path,
+    # and `cms` is pinned `default-features = false` precisely to keep rsa and
+    # RUSTSEC-2023-0071 out of the tree — an avoidance that has to be checked
+    # against the 0.3 feature set rather than assumed.
     #
-    # RETURN WHEN `cms 0.3.0` IS PUBLISHED (not a pre-release). That implies
-    # der/spki/x509-cert/const-oid are all stable, and the whole stack is then
-    # bumped in ONE PR, with the rsa feature check redone rather than assumed.
+    # RETURN WHEN `cms 0.3.0` IS PUBLISHED (not a pre-release). The whole stack
+    # is then bumped in ONE PR (cms, der, x509-cert, const-oid, and these
+    # ignores removed), with the rsa feature check redone.
     ignore:
+      - dependency-name: "der"
       - dependency-name: "x509-cert"
       - dependency-name: "const-oid"
     groups: