diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 64ffc6bf..0a923973 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -42,7 +42,15 @@ updates:
     open-pull-requests-limit: 5
     groups:
       docker-base-image-digests:
+        # Exclude python from the group on purpose. Dependabot's Docker
+        # pre-release filter is bypassed for *grouped* updates
+        # (dependabot-core#9496), so a grouped python update proposes pre-release
+        # tags like python:3.15.0b2 as if they were a normal stable minor bump.
+        # Updated individually, python is filtered correctly: alpha/beta/rc tags
+        # are skipped and only stable releases (e.g. 3.15.0 once final) are
+        # proposed. node + uv stay grouped into a single digest PR.
         patterns: ["*"]
+        exclude-patterns: ["python"]
     ignore:
       # Node.js: block major-version bumps so dependabot never proposes
       # moving from one LTS line to a non-LTS "Current" release (e.g. 24 -> 25).