diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5165125..e6d4058 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,7 +7,7 @@ updates:
     schedule:
       interval: weekly
   - package-ecosystem: pip
-    directory: /preview
+    directory: /
     target-branch: dev
     schedule:
       interval: weekly
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4567021..4a54590 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,8 @@ name: Release
 
 # On main (one squash-merged pull request per release): when pyproject.toml's version has no
 # `v<version>` tag yet, tag it and publish a GitHub release with that version's changelog
-# section. Projects then pin the tag (zepp-devkit @ git+...@vX.Y.Z), and Dependabot sees it.
+# section. Projects then pin the tag (zepp-devkit @ git+...@vX.Y.Z). Then reset dev to main
+# (sync-dev), as zepp-kestrel and zepp-watch-faces do.
 
 on:
   push:
@@ -37,3 +38,27 @@ jobs:
           fi
           zepp-devkit notes CHANGELOG.md "$version" > notes.md
           gh release create "v$version" --target "$GITHUB_SHA" --title "zepp-devkit $version" --notes-file notes.md
+
+  # After a release pull request is merged, dev holds the same files as main but different
+  # commits; reset it to main so the next cycle starts clean. Skipped if dev has new work.
+  # (dev's classic protection rule allows force pushes for this.)
+  sync-dev:
+    needs: [release]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Reset dev to main if they match
+        run: |
+          set -e
+          git rev-parse -q --verify origin/dev >/dev/null || { echo "no dev branch"; exit 0; }
+          if git diff --quiet origin/main origin/dev; then
+            git push --force origin origin/main:refs/heads/dev
+            echo "dev reset to main"
+          else
+            echo "dev has changes that aren't on main: left as it is"
+          fi
diff --git a/CLAUDE.md b/CLAUDE.md
index 50bf1ac..4037c71 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -2,7 +2,8 @@
 
 Shared tooling for the owner's Zepp OS projects (raetha/zepp-kestrel, raetha/zepp-watch-faces, more later): GitHub Actions and scripts for building, test builds, Zepp previews, releases and the emulator. Read `README.md` and `docs/plan.md` first.
 
-- **Branches:** work on `dev`; never push to `main`. A release is one squash-merged pull request from `dev` into `main`, opened when the owner asks: it sets `pyproject.toml`'s and `zepp_devkit/__init__.py`'s version and dates the changelog section. After the merge, CI tags `main` as `vX.Y.Z` and publishes the GitHub release (`release.yml`). Projects pin a commit with the version in a comment, and Dependabot proposes updates there.
+- **Branches:** work on `dev`; never push to `main`. A release is one squash-merged pull request from `dev` into `main`, opened when the owner asks: it sets `pyproject.toml`'s and `zepp_devkit/__init__.py`'s version and dates the changelog section. After the merge, CI tags `main` as `vX.Y.Z`, publishes the GitHub release and resets `dev` to `main` (`release.yml`). Projects pin a commit with the version in a comment, and Dependabot proposes updates there.
+- **Repository settings:** a ruleset protects `main` (pull requests, squash only); merged branches are deleted automatically; a classic rule keeps `dev` from being deleted and allows force pushes: after a release squash merge, CI resets `dev` onto `main` (`sync-dev` in `release.yml`) when nothing new landed on `dev` meanwhile; otherwise reset it by hand once that work is released (`git checkout dev && git reset --hard origin/main && git push --force-with-lease`).
 - Record each change under `## [Unreleased]` in `CHANGELOG.md`, written for the projects using it. Never bump a version or date the changelog without being asked.
 - **Behaviour changes reach every project.** Keep inputs backwards compatible within a major version; a breaking change is a new major version, with the migration in the changelog. Test with the fake Zeus (`test/`), and then in a project's CI before releasing.
 - **Security:** the Zepp login is in each project's secrets, never here. Never print it, the Zepp app's log, or `zeus bridge` output. Actions pinned to commits; `contents: read` unless a job needs more.