diff --git a/renovate.json b/renovate.json
index 90714c3..43b7b03 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,22 +1,49 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:base"
-  ],
+  "extends": ["config:recommended"],
   "timezone": "Australia/Sydney",
   "schedule": ["* * 1 * *"],
-  "docker": {
-    "pinDigests": true
-  },
-  "labels": ["patch"],
+  "rebaseWhen": "conflicted",
+  "docker": {"pinDigests": true},
   "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
+  "labels": ["patch"],
   "separateMajorMinor": false,
   "packageRules": [
     {
-      "groupName": "Package Updates",
-      "groupSlug": "package-updates",
-      "matchUpdateTypes": ["major", "minor", "patch"],
+      "description": "Group non-major dependencies together",
+      "groupName": "Dependencies",
+      "groupSlug": "dependencies",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest", "lockFileMaintenance"],
       "matchPackagePatterns": ["*"]
+    },
+    {
+      "description": "Disable major Go dependency updates (require code changes)",
+      "matchManagers": ["gomod"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
+    {
+      "description": "Disable major docker updates (may require testing)",
+      "matchManagers": ["docker-compose", "dockerfile"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
+    {
+      "description": "Allow major GitHub Actions updates (usually safe)",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "groupName": "GitHub Actions Major",
+      "groupSlug": "github-actions-major"
+    },
+    {
+      "description": "Disable all Python version updates (.python-version and pyproject.toml)",
+      "matchPackageNames": ["python"],
+      "enabled": false
+    },
+    {
+      "description": "Disable pyenv manager (.python-version file updates)",
+      "matchManagers": ["pyenv"],
+      "enabled": false
     }
   ],
   "regexManagers": [