diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ef25e456..5416f8ef 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -28,12 +28,6 @@
       ],
     },
   ],
-  postUpgradeTasks: {
-    commands: [
-      'make vendor-go learn-tools-shas',
-    ],
-    executionMode: 'branch',
-  },
   baseBranchPatterns: [
     'main',
     'octo-sts-poc',
@@ -56,18 +50,18 @@
       matchManagers: [
         'custom.regex',
       ],
-      matchPackageNames: [
-        '*',
-      ]
+      postUpgradeTasks: {
+        commands: [
+          'make vendor-go learn-tools-shas',
+        ],
+        executionMode: 'branch',
+      }
     },
     {
       groupName: 'Misc GitHub actions',
       matchManagers: [
         'github-actions',
       ],
-      matchPackageNames: [
-        '*',
-      ],
       enabled: true,
       matchBaseBranches: [
         'octo-sts-poc',
@@ -78,10 +72,18 @@
       matchManagers: [
         'gomod',
       ],
-      matchPackageNames: [
-        '*',
-      ],
     },
+    {
+      matchManagers: [
+        'custom.regex',
+        'gomod',
+      ],
+      matchUpdateTypes: [
+        'major',
+        'digest',
+      ],
+      dependencyDashboardApproval: true
+    }
   ],
   ignorePaths: [
     '**/vendor/**',
diff --git a/modules/repository-base/base-dependabot/.github/renovate.json5 b/modules/repository-base/base-dependabot/.github/renovate.json5
index bd8871c6..4477854a 100644
--- a/modules/repository-base/base-dependabot/.github/renovate.json5
+++ b/modules/repository-base/base-dependabot/.github/renovate.json5
@@ -37,9 +37,6 @@
       matchManagers: [
         'gomod',
       ],
-      matchPackageNames: [
-        '*',
-      ],
     },
     {
       groupName: 'Testing Go deps',
@@ -105,12 +102,22 @@
       ],
     },
     {
-      description: 'Disable Go pseudo-version updates',
+      matchManagers: [
+        'gomod',
+      ],
+      matchUpdateTypes: [
+        'major',
+        'digest',
+      ],
+      dependencyDashboardApproval: true
+    },
+    {
+      description: 'Disable (internal) cert-manager pseudo-version updates',
       matchManagers: [
         'gomod',
       ],
       matchPackageNames: [
-        '*',
+        'github.com/cert-manager/**',
       ],
       matchCurrentValue: 'v0.0.0*',
       enabled: false,