diff --git a/renovate.json b/renovate.json
index 888f672..88315c1 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,5 +5,62 @@
 	],
 	"labels": [
 		"dependencies"
+	],
+	"packageRules": [
+		{
+			"description": "Cargo dependencies, the Rust toolchain pin, prek (via mise) and the workflows' own actions merge by pushing to main, without a pull request. ci.yml runs on `push: [\"**\"]`, so the Renovate branch itself is compiled, linted with `clippy -D warnings` and unit-tested first; a failure leaves the branch red and Renovate raises a pull request instead of merging.",
+			"matchManagers": [
+				"cargo",
+				"rust-toolchain",
+				"mise",
+				"github-actions"
+			],
+			"matchUpdateTypes": [
+				"minor",
+				"patch",
+				"digest"
+			],
+			"automerge": true,
+			"automergeType": "branch",
+			"platformAutomerge": false
+		},
+		{
+			"description": "The release image's base (Dockerfile and Dockerfile.ci). Gated by ci.yml's docker-build job, which builds the image exactly as Publish does but with `push: false`, and which only runs when a Dockerfile actually changed.",
+			"matchManagers": [
+				"dockerfile"
+			],
+			"matchUpdateTypes": [
+				"minor",
+				"patch",
+				"digest"
+			],
+			"automerge": true,
+			"automergeType": "branch",
+			"platformAutomerge": false
+		},
+		{
+			"description": "Local development service images under etc/services/** - the homeservers and LLM backends that `just services-start` brings up. They are never part of a shipped artifact and CI does not run them, so the justification here is blast radius rather than validation: the worst case is a broken local development stack, fixed by pinning back.",
+			"matchManagers": [
+				"docker-compose"
+			],
+			"matchFileNames": [
+				"etc/services/**"
+			],
+			"matchUpdateTypes": [
+				"minor",
+				"patch",
+				"digest"
+			],
+			"automerge": true,
+			"automergeType": "branch",
+			"platformAutomerge": false
+		},
+		{
+			"description": "Major updates always get a pull request and a human. This is deliberately the last rule so that it overrides the automerge rules above for every manager.",
+			"matchUpdateTypes": [
+				"major"
+			],
+			"automerge": false
+		}
 	]
 }