diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6fdee67..2ba6196 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,4 +15,12 @@ updates:
     groups:
       python:
         patterns:
-          - "*"
\ No newline at end of file
+          - "*"
+    ignore:
+      # The `mcp<2` cap in pyproject.toml does not hold on its own: dependabot rewrites the
+      # constraint it finds (it proposed `mcp>=2.0.0,<3`) rather than staying inside it. Only
+      # an ignore condition keeps 2.x out of the weekly group. SDK 2.0 removes
+      # `mcp.server.fastmcp` entirely, so the adapter does not import under it — the port is a
+      # deliberate PR, not a dependency bump. Drop this entry when that migration lands.
+      - dependency-name: "mcp"
+        update-types: ["version-update:semver-major"]
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index 11b1175..4de5be4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -23,6 +23,8 @@ dependencies = [
     # Capped below 2.0: that release removes `mcp.server.fastmcp` entirely (FastMCP ->
     # MCPServer) and moves transport config off the constructor, so the adapter does not
     # import under it. Migration is a deliberate PR, not a dependency bump.
+    # The cap alone does not hold the line — dependabot rewrites it. The matching ignore
+    # condition in .github/dependabot.yml is what actually keeps 2.x out; change both together.
     "mcp>=1.28.1,<2",
 ]