diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml
index fc836bc5..4e27cfd6 100644
--- a/.github/workflows/merge-bot-pull-request.yml
+++ b/.github/workflows/merge-bot-pull-request.yml
@@ -13,7 +13,7 @@ jobs:
   merge-dependabot:
     name: Merge dependabot pull request job
     runs-on: ubuntu-latest
-    # Must come from dependabot, and the PR must be from the same repository to prevent abuse
+    # To prevent abuse, the PR must come from Dependabot and the PR must originate from this repository.
     if: >-
       github.actor == 'dependabot[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository
@@ -29,8 +29,12 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # Merge any non-NuGet update, e.g. GitHub Actions often updates v1 to v2.
+      # Merge NuGet only for non-major updates, e.g. major updates may build but break functionality.
       - name: Merge pull request step
-        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+        if: >-
+          (steps.metadata.outputs.package-ecosystem != 'nuget') ||
+          (steps.metadata.outputs.update-type != 'version-update:semver-major')
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
@@ -39,7 +43,7 @@ jobs:
   merge-codegen:
     name: Merge codegen pull request job
     runs-on: ubuntu-latest
-    # Must come from the codegen workflow, and the PR must be from the same repository to prevent abuse
+    # To prevent abuse, the PR must come from the codegen workflow, and the PR must originate from this repository.
     if: >-
       github.event.pull_request.user.login == 'github-actions[bot]' &&
       github.event.pull_request.head.ref == 'codegen' &&
@@ -64,7 +68,7 @@ jobs:
   merge-codegen-app:
     name: Merge codegen app pull request job
     runs-on: ubuntu-latest
-    # Must come from the codegen app workflow, and the PR must be from the same repository to prevent abuse
+    # To prevent abuse, the PR must come from the codegen app workflow, and the PR must originate from this repository.
     if: >-
       github.actor == 'ptr727-codegen[bot]' &&
       github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&