diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 89929dd43..fcd4a579f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -76,6 +76,26 @@ updates:
         applies-to: "security-updates"
         patterns:
           - "*"
+    # The offline browser-verification runtime is pinned to Playwright 1.56.1,
+    # so frontend browser proofs require lockfile parity. Keep Playwright on the
+    # governed 1.56.1 line; review upgrades as explicit work alongside a runtime
+    # change, matching the docker governed-tag policy.
+    ignore:
+      - dependency-name: "playwright"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+      - dependency-name: "playwright-core"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+      - dependency-name: "@playwright/test"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
 
   - package-ecosystem: "docker"
     directories:
diff --git a/scripts/tests/test_dependabot_config.py b/scripts/tests/test_dependabot_config.py
index 114063ddd..ce8b6a180 100644
--- a/scripts/tests/test_dependabot_config.py
+++ b/scripts/tests/test_dependabot_config.py
@@ -136,6 +136,22 @@ class DependabotConfigTest(unittest.TestCase):
             ],
         )
 
+    def test_npm_updates_preserve_browser_runtime_parity(self) -> None:
+        all_semver = {
+            "version-update:semver-major",
+            "version-update:semver-minor",
+            "version-update:semver-patch",
+        }
+        ignored = {
+            item["dependency-name"]: set(item["update-types"])
+            for item in self.updates["npm"]["ignore"]
+        }
+        self.assertEqual(
+            set(ignored),
+            {"playwright", "playwright-core", "@playwright/test"},
+        )
+        self.assertTrue(all(types == all_semver for types in ignored.values()))
+
     def test_weekly_scan_covers_the_same_lockfiles(self) -> None:
         workflow = yaml.safe_load(SECURITY_SCAN.read_text(encoding="utf-8"))
         jobs = workflow["jobs"]