diff --git a/.mergify.yml b/.mergify.yml
index 355592b4bb..a5d0bcfd16 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -44,7 +44,11 @@ merge_protections:
       - or: &DefaultReviewCond
           - "#approved-reviews-by >= 2"
           - author = dependabot[bot]
-          - author = mergify-ci-bot
+          # mergify-ci-bot needs no approval for the deterministic syncers, but
+          # the docs agent writes prose under docs-agent/* and gets no free pass.
+          - and:
+              - author = mergify-ci-bot
+              - "-head ~= ^docs-agent/"
 
   - name: 🧑‍🚒 Hotfix Review Requirements
     if:
@@ -81,8 +85,13 @@ queue_rules:
   - name: default
     <<: *DefaultQueueOptions
     queue_conditions:
-      - author != mergify-ci-bot
-      - author != dependabot[bot]
+      # docs-agent branches are excluded from the automated updates lane below,
+      # so they have to land here or they would match no queue at all.
+      - or:
+          - and:
+              - author != mergify-ci-bot
+              - author != dependabot[bot]
+          - head ~= ^docs-agent/
     merge_conditions:
       - schedule=Mon-Fri 09:00-17:30[Europe/Paris]
 
@@ -93,6 +102,7 @@ queue_rules:
       - or:
           - author = mergify-ci-bot
           - author = dependabot[bot]
+      - "-head ~= ^docs-agent/"
     batch_size: 10
     batch_max_wait_time: 5min
 
@@ -100,7 +110,14 @@ pull_request_rules:
   - name: request review
     conditions:
       - -author=dependabot[bot]
-      - -author=mergify-ci-bot
+      # Bots are not routed for review, except the docs agent, which now needs
+      # two approvals like anyone else. Gated on -draft so the ten drafts a
+      # Monday audit opens do not each ping the team before a human wants them.
+      - or:
+          - -author=mergify-ci-bot
+          - and:
+              - head ~= ^docs-agent/
+              - -draft
       - -merged
       - -closed
       - and: *CheckRuns