diff --git a/gh-dependabot.tf b/gh-dependabot.tf
index 23300d0..3ee25b6 100644
--- a/gh-dependabot.tf
+++ b/gh-dependabot.tf
@@ -70,6 +70,16 @@ resource "github_repository_file" "dependabot" {
   content             = "# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.\n${yamlencode(each.value)}"
   commit_message      = "chore: sync managed dependabot configuration"
   overwrite_on_create = true
+
+  # These attributes are creation/commit metadata, not the centrally managed
+  # file content. Ignoring imported values avoids a protected-branch write when
+  # adopting a PR-seeded file; future content changes remain managed.
+  lifecycle {
+    ignore_changes = [
+      commit_message,
+      overwrite_on_create,
+    ]
+  }
 }
 
 locals {
@@ -106,4 +116,13 @@ resource "github_repository_file" "dependabot_notify" {
   content             = local.dependabot_notify_workflow
   commit_message      = "chore: sync managed dependabot notification workflow"
   overwrite_on_create = true
+
+  # See github_repository_file.dependabot above. The workflow content remains
+  # managed; only imported creation/commit metadata is ignored.
+  lifecycle {
+    ignore_changes = [
+      commit_message,
+      overwrite_on_create,
+    ]
+  }
 }
diff --git a/imports.tf b/imports.tf
index ee7af2b..f398a88 100644
--- a/imports.tf
+++ b/imports.tf
@@ -7,3 +7,16 @@ import {
   to = github_repository.repositories["channel-project"]
   id = "channel-project"
 }
+
+# These files were seeded through tfroot-twilio PR #1 because its temporary
+# protection rejects direct file creation. Import them before central management
+# so the first reconciled apply does not attempt another protected direct write.
+import {
+  to = github_repository_file.dependabot["tfroot-twilio"]
+  id = "tfroot-twilio:.github/dependabot.yml:"
+}
+
+import {
+  to = github_repository_file.dependabot_notify["tfroot-twilio"]
+  id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:"
+}