Signal / 003 — Dependabot gets a route beyond the default runner

SYSVOID SIGNAL // BUILD // SEPTEMBER 30, 2026

Automation gets interesting when your project stops fitting the default environment. GitHub’s September 29 update gives repository administrators another way to decide where Dependabot runs.

Route updates to the right machine

GitHub says private and internal repositories on github.com can now select a runner type, custom label, and runner group for Dependabot’s version and security updates. Labeled runners can point to self-hosted machines or larger GitHub-hosted runners—for example, when a project needs access to a private package registry.

The controls are not available for public repositories or GitHub Enterprise Server. GitHub also notes that security configurations do not currently enforce these runner settings.

Find the switch

In repository Settings, open Advanced Security, then Dependency scanning. Under Dependabot version updates, edit Runner type. The labeled option uses dependabot when no custom label is supplied; the standard option keeps GitHub’s default hosted environment.

The sysVoid take

Our take: Useful automation should fit the project. This is a practical control for teams with unusual infrastructure, rather than a reason to complicate a setup that already works.

Read GitHub’s announcement — September 29, 2026

AI-assisted summary of GitHub’s announcement. No hands-on testing; commentary is labeled separately.