diff --git a/VERSION b/VERSION
index 815d5ca..66e2ae6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.19.0
+1.19.1
diff --git a/docs/index.html b/docs/index.html
index f46b327..dbfc19b 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -345,7 +345,7 @@ <h3>Scaffold Generator</h3>
       </div>
       <div class="footer-divider"></div>
       <div class="footer-meta">
-        <span id="footerVersion">v1.19.0</span>
+        <span id="footerVersion">v1.19.1</span>
         <span>&middot;</span>
         <span>CC-BY-NC-ND-4.0</span>
         <span>&middot;</span>
diff --git a/scaffold/templates/dependabot.yml.j2 b/scaffold/templates/dependabot.yml.j2
index b7a8f3b..743ee94 100644
--- a/scaffold/templates/dependabot.yml.j2
+++ b/scaffold/templates/dependabot.yml.j2
@@ -22,6 +22,10 @@ updates:
       # of the supported runtimes.
       - dependency-name: "@types/node"
         versions: [">=23"]
+      # Hold vitest 3.x. A 4.x bump rewrote the lockfile without optional
+      # esbuild platform packages, so npm ci failed. Major upgrades stay manual.
+      - dependency-name: "vitest"
+        update-types: ["version-update:semver-major"]
 {% endif %}
 {% if has_mcp %}
   - package-ecosystem: "pip"
diff --git a/tests/test_scaffold_born_green.py b/tests/test_scaffold_born_green.py
index 96eb68b..f18a971 100644
--- a/tests/test_scaffold_born_green.py
+++ b/tests/test_scaffold_born_green.py
@@ -338,6 +338,9 @@ def test_deployed_service_shape(rendered):
     assert "gh workflow run publish.yml" in (
         library / ".github" / "workflows" / "release.yml"
     ).read_text(encoding="utf-8")
+    dep = (library / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    assert 'dependency-name: "vitest"' in dep
+    assert "version-update:semver-major" in dep
 
 
 def _make_temp_registry_root(tmp_path: Path) -> Path: