diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c7d919b3..5d7d76cc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,6 +33,12 @@ updates:
     target-branch: "development"
     schedule:
       interval: "weekly"
+    ignore:
+      # @nextcloud/webpack-vue-config pins this to EXACTLY "4.0.0" (not a
+      # range), so 4.1.0 can never resolve: npm ci dies with ERESOLVE before
+      # a single check runs. Dependabot proposes it anyway because it only
+      # sees a newer version, not the exact pin holding it down.
+      - dependency-name: "node-polyfill-webpack-plugin"
     open-pull-requests-limit: 10
     # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a
     # package we do not control, and dependabot cannot see that, so it proposes
diff --git a/package.json b/package.json
index 919186d1..513e5777 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "gridstack": "^12.6.0",
     "lodash": "^4.17.21",
     "marked": "^12.0.0",
-    "node-polyfill-webpack-plugin": "4.1.0",
+    "node-polyfill-webpack-plugin": "4.0.0",
     "path-browserify": "^1.0.1",
     "pinia": "^3.0.3",
     "sass": "^1.99.0",