self-host →

Dependabot

Run Dependabot update jobs on RunsOn Flex or Fleet self-hosted runners.

GitHub can run Dependabot update jobs on self-hosted runners for private repositories. The routing setup differs between Fleet and Flex.

Fleet#

Fleet runner scale sets use a single compound label. GitHub lets an organization owner configure Dependabot to target that custom label, such as:

runs-on/fleet=dependabot-x64/env=production

The fleet name and environment must match a fleet in your Fleet configuration. GitHub creates the Dependabot job, so there is no workflow YAML to change.

Configure the label at the organization level:

  1. Open your organization’s Settings → Advanced Security → Global settings, or go directly to https://github.com/organizations/<ORG>/settings/security_analysis.
  2. Under Dependabot, edit Runner type and select Labeled runner.
  3. Enter the full Fleet label in Runner label.
  4. Optionally, enter the fleet’s runner group in Runner group name to restrict routing further.
  5. Save the runner selection.

GitHub announced organization-level custom labels for Dependabot in November 2025 ↗.

Flex#

Flex uses GitHub’s default dependabot runner label. Define a pool named exactly dependabot in your organization’s .github-private/.github/runs-on.yml file:

.github-private/.github/runs-on.yml
runners:
  small-x64:
    image: ubuntu24-full-x64
    ram: 2
    family: [t3]
    volume: gp3:30gb:125mbps:3000iops


pools:
  dependabot:
    env: production
    runner: small-x64
    schedule:
      - name: default
        stopped: 2
        hot: 0

This example keeps two stopped instances ready for Dependabot jobs. Adjust the pool schedule for your workload. The RunsOn GitHub App must have access to the .github-private repository.

When RunsOn receives a job with the dependabot label, it expands the label internally to runs-on/pool=dependabot. Keep the organization runner label set to the default dependabot value when using this Flex integration.

Enable repositories#

In each private repository that should use RunsOn, open Settings → Advanced Security, or go directly to https://github.com/<ORG>/<REPO>/settings/security_analysis, and enable Dependabot on self-hosted runners.

After you enable this setting, Dependabot jobs wait for a runner with the configured label. A misspelled label or missing pool leaves jobs queued indefinitely. GitHub does not run Dependabot updates from public repositories on self-hosted runners.