diff --git a/.github/renovate.json b/.github/renovate.json
index 3c12db5965..bb444bf9c2 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -3,10 +3,11 @@
   "configMigration": true,
   "extends": [
     "config:recommended",
+    "helpers:pinGitHubActionDigests",
     "group:allNonMajor",
     "schedule:weekly",
+    "security:minimumReleaseAgeNpm",
     ":approveMajorUpdates",
-    ":automergeMinor",
     ":disablePeerDependencies",
     ":maintainLockFilesMonthly",
     ":semanticCommits",