From 87cd0a0dc9dd2a7e4c29f84bb8e46df36e957932 Mon Sep 17 00:00:00 2001
From: Ubiratan Soares <ubiratan.f.soares@gmail.com>
Date: Wed, 7 Oct 2026 09:05:50 +0200
Subject: [PATCH] docs(policy): clarify opt in for dependabot audits

---
 zizmor-policy.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/zizmor-policy.yml b/zizmor-policy.yml
index ae7991e..6ce69b5 100644
--- a/zizmor-policy.yml
+++ b/zizmor-policy.yml
@@ -14,8 +14,6 @@ default:
       disable: false
     cache-poisoning:
       disable: false
-    dependabot-execution:
-      disable: false
     github-env:
       disable: false
     hardcoded-container-credentials:
@@ -67,7 +65,13 @@ default:
       disable: true
     dangerous-triggers:
       disable: true
+    # rust-lang repos also adopt Renovate for dependency updates,
+    # hence related Dependabot-related audits are disabled by default.
     dependabot-cooldown:
+      # Repositories using Dependabot should enable this audit
+      disable: true
+    dependabot-execution:
+      # Repositories using Dependabot should enable this audit
       disable: true
     excessive-permissions:
       disable: true