diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index af04d92..cb65dac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,19 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - "dependencies"
+    ignore:
+      # The [dev] black cap tracks the black rev pinned in
+      # .pre-commit-config.yaml, and the two move together by hand. A
+      # Dependabot bump of the cap alone splits CI from the local hook.
+      # Name-only on purpose: an update-types ignore is computed from the first
+      # X.Y.Z version in the requirement, and `>=24.0,<25.10` has none, so it
+      # would match nothing. Security updates are not blocked by it: in
+      # dependabot-core, IgnoreCondition#ignored_versions returns early for
+      # security_updates_only with just the explicit `versions`, and a
+      # name-only ignore has none. Black's security fixes since 25.9.0 need
+      # Python 3.10+, so a security PR for it is a decision about the 3.9
+      # floor and the hook rev, not a plain merge.
+      - dependency-name: "black"
 
   # GitHub Actions used by the CI and publish workflows.
   - package-ecosystem: "github-actions"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 200f675..d9b751c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,8 @@
 # Pre-commit hooks for snowflake-sql-api. Install with `pre-commit install`
 # (the hook then runs on every commit); run the full set with
-# `pre-commit run --all-files`. Hook versions track the `[dev]` floors in
-# pyproject.toml.
+# `pre-commit run --all-files`. The black rev is pinned to match the `[dev]`
+# black cap in pyproject.toml (see its comment); the other revs are set here
+# independently of the `[dev]` floors.
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.15.17
@@ -9,8 +10,9 @@ repos:
       - id: ruff-check
 
   - repo: https://github.com/psf/black
-    # Last black that still runs on Python 3.9 (the project's runtime floor);
-    # 25.12.0+ require 3.10+. Kept in sync with the [dev] cap in pyproject.toml.
+    # Kept in sync with the [dev] cap in pyproject.toml (<25.10); move both
+    # together by hand. Stay on a black that runs on Python 3.9 (the project's
+    # runtime floor): 25.11.0 is the last one, 25.12.0+ require 3.10.
     rev: 25.9.0
     hooks:
       - id: black
diff --git a/pyproject.toml b/pyproject.toml
index cee7f78..ab699d1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,9 +41,12 @@ dev = [
     "pytest-asyncio>=0.21",
     "respx>=0.20",
     "ruff>=0.4",
-    # Capped below 25.10: 25.12.0+ drop Python 3.9, which the package still
-    # supports. Keeps CI and the pinned pre-commit hook on the same black.
-    "black>=24.0,<26.11",
+    # Capped below 25.10 so CI formats with the same black the pre-commit hook
+    # pins (rev 25.9.0 in .pre-commit-config.yaml). Move the two together by
+    # hand; Dependabot ignores black (.github/dependabot.yml). Keep the cap at
+    # or below 25.12 while Python 3.9 is supported: 25.12.0+ require 3.10, so
+    # a higher cap resolves a different black per interpreter.
+    "black>=24.0,<25.10",
     "mypy>=1.8",
     "build>=1.0",
     "pre-commit>=3.5",
diff --git a/tests/test_import_footprint.py b/tests/test_import_footprint.py
index 147fb3a..e915985 100644
--- a/tests/test_import_footprint.py
+++ b/tests/test_import_footprint.py
@@ -64,7 +64,9 @@ def exec_module(self, module):
 sys.meta_path.insert(0, _Recorder())
 import snowflake_sql_api  # noqa: F401
 print(",".join(sorted(set(attempted))))
-""".format(forbidden=FORBIDDEN_ON_BARE_IMPORT)
+""".format(
+    forbidden=FORBIDDEN_ON_BARE_IMPORT
+)
 
 _TIMING_SCRIPT = """
 import time