diff --git a/.circleci/config.yml b/.circleci/config.yml
index cfbc48460..6668d1052 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -112,11 +112,22 @@ jobs:
       - checkout
       - attach_workspace:
           at: ~/repo
-      # SECURITY AUDIT
+      # SECURITY AUDIT - only when bun.lock has changed
       - run:
           name: 'Security Audit - High Risk Vulnerabilities'
           command: |
-            echo "🔍 Running bun audit for security vulnerabilities..."
+            git fetch origin master 2>/dev/null || true
+            BASE_REF=$(git merge-base HEAD origin/master 2>/dev/null)
+            if [[ -z "$BASE_REF" ]]; then
+              echo "Could not determine base ref (e.g. shallow clone or no origin/master), skipping security audit."
+              exit 0
+            fi
+            CHANGED_FILES=$(git diff --name-only origin/master...HEAD 2>/dev/null || echo "")
+            if ! echo "$CHANGED_FILES" | grep -qx 'bun.lock'; then
+              echo "⏭️ bun.lock unchanged - skipping security audit."
+              exit 0
+            fi
+            echo "🔍 bun.lock changed - running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
             # Define ignored vulnerabilities with comments
diff --git a/.github/.dependabot.yaml b/.github/.dependabot.yaml
index fb9089fbc..87d5e594b 100644
--- a/.github/.dependabot.yaml
+++ b/.github/.dependabot.yaml
@@ -2,6 +2,8 @@ version: 2
 enable-beta-ecosystems: true
 updates:
   - package-ecosystem: 'bun'
+    # Disable all pull requests for bun version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'
@@ -10,6 +12,8 @@ updates:
       prefix: 'chore'
       include: 'scope'
   - package-ecosystem: 'npm'
+    # Disable all pull requests for npm version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'