diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cda0160a..544432ac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,3 +1,6 @@
+# It's unclear whether this configuration is supported for stopping dev only
+# security issues, see https://github.com/usds/justice40-tool/issues/1121 and
+# https://github.com/dependabot/dependabot-core/issues/2521.
 version: 2
 updates:
   - package-ecosystem: "npm"