diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e684638..9b92698 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:
diff --git a/pyproject.toml b/pyproject.toml
index 0b46612..1866cdc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -133,6 +133,8 @@ Changelog = "https://github.com/VocaHQ/vocalinux/releases"
 # Contributors may use uv 0.12 or 0.13. CI and lock/export generation use
 # uv 0.13.3 for reproducible export formatting (see `just lock`).
 required-version = ">=0.12,<0.14"
+# Supply-chain cooldown: wait a week before resolving newly published releases.
+exclude-newer = "7 days"
 
 [tool.setuptools]
 # Resource dirs carry no .py files, but setuptools still treats them as packages.
diff --git a/uv.lock b/uv.lock
index 199f238..b497bb4 100644
--- a/uv.lock
+++ b/uv.lock
@@ -10,6 +10,10 @@ resolution-markers = [
     "python_full_version < '3.12' and sys_platform == 'ios'",
 ]
 
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P7D"
+
 [[package]]
 name = "alabaster"
 version = "1.0.0"