diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 98fbe1973..e6ce4f9b0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,7 +12,7 @@ updates:
     registries:
       - github-basecamp
     directory: "/"
-    insecure-external-code-execution: allow
+    insecure-external-code-execution: allow # zizmor: ignore[dependabot-execution] -- required for Bundler to resolve gems from the private github-basecamp registry
     open-pull-requests-limit: 10
     vendor: false
     groups: