diff --git a/components/publicRepo.ts b/components/publicRepo.ts
index d3e1420..36703a2 100644
--- a/components/publicRepo.ts
+++ b/components/publicRepo.ts
@@ -27,6 +27,8 @@ export interface PublicRepoArgs {
 	topics?: Input<Input<string>[]>;
 	/** Passed through to the repository resource, for adopting one that already exists. */
 	repoOptions?: CustomResourceOptions;
+	/** Whether Dependabot raises alerts for the repository. Defaults to enabled. */
+	vulnerabilityAlerts?: Input<boolean>;
 }
 
 export class PublicRepo extends Repo {
@@ -51,6 +53,7 @@ export class PublicRepo extends Repo {
 					topics: args.topics,
 				},
 				repoOptions: args.repoOptions,
+				vulnerabilityAlerts: args.vulnerabilityAlerts,
 			},
 			opts,
 		);
diff --git a/components/repo.ts b/components/repo.ts
index c904c6e..2d64cf2 100644
--- a/components/repo.ts
+++ b/components/repo.ts
@@ -1,5 +1,5 @@
 import * as gh from '@pulumi/github';
-import { ComponentResource, ComponentResourceOptions, CustomResourceOptions } from '@pulumi/pulumi';
+import { ComponentResource, ComponentResourceOptions, CustomResourceOptions, Input } from '@pulumi/pulumi';
 
 export interface RepoArgs {
 	overrides: Partial<gh.RepositoryArgs>;
@@ -9,6 +9,8 @@ export interface RepoArgs {
 	 * alias for one whose URN is moving.
 	 */
 	repoOptions?: CustomResourceOptions;
+	/** Whether Dependabot raises alerts for the repository. Defaults to enabled. */
+	vulnerabilityAlerts?: Input<boolean>;
 }
 
 export abstract class Repo extends ComponentResource {
@@ -38,6 +40,7 @@ export abstract class Repo extends ComponentResource {
 
 		const vulnerabilityAlerts = new gh.RepositoryVulnerabilityAlerts(name, {
 			repository: repo.name,
+			enabled: args.vulnerabilityAlerts,
 		}, { parent: this });
 
 		this.repo = repo;
diff --git a/index.ts b/index.ts
index 67a1090..fcd50fe 100644
--- a/index.ts
+++ b/index.ts
@@ -124,6 +124,10 @@ const pkgs = new PublicRepo('pkgs', {
 	description: 'Mini nixpkgs — personal Nix package collection',
 	topics: ['nix', 'nixpkgs', 'nix-flake'],
 	githubChecks: ['build (x86_64-linux)'],
+	// Lockfiles under pkgs/ record what upstream projects pin, not what this
+	// repo depends on. Their advisories are unactionable here and accumulate
+	// with every package added.
+	vulnerabilityAlerts: false,
 });
 
 const terraform2crd = new PublicRepo('terraform2crd', {