diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1f5d39386d39c4..0d367e01bca224 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -28,6 +28,17 @@ updates:
     cooldown:
       default-days: 14
 
+  - package-ecosystem: "npm"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
   # Release branches: Dependabot only reads this file from the default
   # branch, so each branch that should get its own actions bumps needs an
   # entry here with `target-branch`. Add one when a new release branch is
@@ -117,3 +128,29 @@ updates:
         patterns: ["*"]
     cooldown:
       default-days: 14
+
+  # Only bump bugfix branches for npm. Remove
+  # the entry when branch goes security-only.
+  - package-ecosystem: "npm"
+    target-branch: "3.15"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "npm"
+    target-branch: "3.14"
+    directory: "/Platforms/emscripten/browser_test/"
+    schedule:
+      interval: "quarterly"
+    labels: ["OS-emscripten", "skip issue", "skip news"]
+    groups:
+      npm:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14