diff --git a/.github/workflows/actions-maintenance.yml b/.github/workflows/actions-maintenance.yml
deleted file mode 100644
index e5a9f5e..0000000
--- a/.github/workflows/actions-maintenance.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-# =============================================================================
-# Actions Maintenance — Auto-merge Dependabot PRs (GitHub Actions)
-# =============================================================================
-# When Dependabot opens a PR bumping a GitHub Action version inside
-# .github/workflows/** (e.g. actions/checkout, actions/setup-python), this
-# workflow auto-approves and enables native auto-merge. GitHub merges once all
-# required status checks pass.
-#
-# Mirrors docker-maintenance.yml (base image) — same reusable module, scoped to
-# the workflow files instead of the Dockerfile. Keeps external Action pins from
-# silently drifting out of date (the checkout@v5 → @v7 drift that surfaced as a
-# stale open PR is exactly what this closes automatically going forward).
-# =============================================================================
-
-name: ⚙️ Actions Maintenance
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    paths:
-      - '.github/workflows/**'
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  maintenance:
-    name: Auto-merge Dependabot PRs
-    uses: bauer-group/automation-templates/.github/workflows/docker-maintenance-dependabot.yml@main
-    with:
-      merge-method: 'squash'
-      auto-approve: true
-    secrets: inherit
diff --git a/.github/workflows/docker-maintenance.yml b/.github/workflows/docker-maintenance.yml
index 9f90b86..f5e0a3d 100644
--- a/.github/workflows/docker-maintenance.yml
+++ b/.github/workflows/docker-maintenance.yml
@@ -1,10 +1,18 @@
 # =============================================================================
-# Docker Maintenance — Auto-merge Dependabot PRs (base image)
+# Docker Maintenance — Auto-merge Dependabot PRs (every ecosystem)
 # =============================================================================
-# When Dependabot opens a PR bumping the base image in ./Dockerfile
-# (python:3.14-alpine), this workflow auto-approves and merges it after
-# validation passes, which then triggers docker-release.yml to build and push
-# the updated image.
+# Every Dependabot PR reaches this workflow (no paths: filter), so each one
+# gets an explicit decision and annotation instead of silently staying open.
+# A PR is merged only after the pull_request run of docker-release.yml passed
+# on its head commit - pytest, the e2e backup round trips and the image build:
+#
+#   docker          Dockerfile              the image is built from it
+#   pip             pyproject.toml          pytest, image build (pytest gate)
+#   docker-compose  docker-compose.e2e.yml  the round trips start its servers
+#   github-actions  .github/workflows/**    never merged: a CI change
+#
+# A PR whose files do not start docker-release.yml stays open as "not
+# tested". The merge is made with GITHUB_TOKEN and starts no push workflow.
 # =============================================================================
 
 name: 🔧 Docker Maintenance
@@ -12,8 +20,6 @@ name: 🔧 Docker Maintenance
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
-    paths:
-      - 'Dockerfile'
 
 permissions:
   contents: write