diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml
index ba052f0..00cc371 100644
--- a/.github/workflows/on-pr.yaml
+++ b/.github/workflows/on-pr.yaml
@@ -10,6 +10,7 @@ on:
       - reopened
       - synchronize
     paths:
+      - 'renovate.json'
       - '.github/workflows/on-pr.yaml'
       - 'apis/**'
       - 'examples/**'
diff --git a/functions/render/000-state-init.yaml.gotmpl b/functions/render/000-state-init.yaml.gotmpl
index ce69395..c635027 100644
--- a/functions/render/000-state-init.yaml.gotmpl
+++ b/functions/render/000-state-init.yaml.gotmpl
@@ -48,6 +48,7 @@
 {{- end }}
 {{- $kyNamespace := $ky.namespace | default "kyverno" }}
 {{- $kyReleaseName := $ky.releaseName | default "kyverno" }}
+# renovate: datasource=helm depName=kyverno registryUrl=https://kyverno.github.io/kyverno/
 {{- $kyChartVersion := $ky.chartVersion | default "3.8.0" }}
 
 # ==============================================================================
@@ -60,6 +61,7 @@
 {{- end }}
 {{- $prNamespace := $pr.namespace | default "policy-reporter" }}
 {{- $prReleaseName := $pr.releaseName | default "policy-reporter" }}
+# renovate: datasource=helm depName=policy-reporter registryUrl=https://kyverno.github.io/policy-reporter/
 {{- $prChartVersion := $pr.chartVersion | default "3.7.4" }}
 
 # ==============================================================================
diff --git a/renovate.json b/renovate.json
index 820ceb8..85f0cfc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -12,27 +12,62 @@
   },
   "packageRules": [
     {
-      "description": "Automerge minor and patch updates that pass all checks",
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
+      "description": "Require manual merge until an e2e suite exists",
+      "matchUpdateTypes": [
+        "major",
+        "minor",
+        "patch"
+      ],
+      "automerge": false
     },
     {
       "description": "Disable automatic updates for all hops-ops Docker images",
-      "matchDatasources": ["docker"],
+      "matchDatasources": [
+        "docker"
+      ],
       "enabled": false,
-      "matchPackageNames": ["/^hops-ops//"]
+      "matchPackageNames": [
+        "/^hops-ops//"
+      ]
+    },
+    {
+      "description": "Group AWS provider-family packages",
+      "matchPackageNames": [
+        "/provider-family-aws/",
+        "/provider-aws-.*/"
+      ],
+      "groupName": "aws-providers"
     },
     {
       "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)",
-      "matchManagers": ["custom.regex"],
-      "matchDatasources": ["github-releases"],
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "github-releases"
+      ],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "deps"
+    },
+    {
+      "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "github-releases"
+      ],
       "semanticCommitType": "feat",
       "semanticCommitScope": "deps"
     },
     {
       "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries",
-      "matchManagers": ["custom.regex"],
-      "matchDatasources": ["docker"],
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
       "semanticCommitType": "feat",
       "semanticCommitScope": "deps"
     }
@@ -41,30 +76,62 @@
     {
       "customType": "regex",
       "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "github-releases",
-      "packageNameTemplate": "hops-ops/{{depName}}"
+      "versioningTemplate": "npm",
+      "packageNameTemplate": "hops-ops/{{depName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "description": "Crossplane packages from other registries (tracked via Docker tags)",
+      "description": "Crossplane packages from xpkg registries (tracked via Docker tags)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>xpkg\\.[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "docker",
+      "versioningTemplate": "npm",
       "registryUrlTemplate": "https://{{registryUrl}}",
       "depNameTemplate": "{{orgName}}/{{repoName}}",
-      "packageNameTemplate": "{{orgName}}/{{repoName}}"
+      "packageNameTemplate": "{{orgName}}/{{repoName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
+    },
+    {
+      "customType": "regex",
+      "description": "Annotated runtime dependencies in schemas, templates, examples, and tests",
+      "managerFilePatterns": [
+        "apis/**/*.yaml",
+        "examples/**/*.yaml",
+        "functions/**/*.yaml.gotmpl",
+        "tests/**/*.k"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?<currentValue>v?[0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?<currentValue>v?[A-Za-z0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?<currentValue>[^\"]+)\""
+      ]
     }
+  ],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/__fixtures__/**",
+    "**/fixtures/**"
   ]
 }
diff --git a/tests/test-render/main.k b/tests/test-render/main.k
index 6b58872..277fc6c 100644
--- a/tests/test-render/main.k
+++ b/tests/test-render/main.k
@@ -34,6 +34,7 @@ _items = [
                         chart = {
                             name = "kyverno"
                             repository = "https://kyverno.github.io/kyverno/"
+                            # renovate: datasource=helm depName=kyverno registryUrl=https://kyverno.github.io/kyverno/
                             version = "3.8.0"
                         }
                         namespace = "kyverno"
@@ -53,6 +54,7 @@ _items = [
                         chart = {
                             name = "policy-reporter"
                             repository = "https://kyverno.github.io/policy-reporter/"
+                            # renovate: datasource=helm depName=policy-reporter registryUrl=https://kyverno.github.io/policy-reporter/
                             version = "3.7.4"
                         }
                         namespace = "policy-reporter"
diff --git a/upbound.yaml b/upbound.yaml
index 39b8201..0256040 100644
--- a/upbound.yaml
+++ b/upbound.yaml
@@ -7,15 +7,15 @@ spec:
   - apiVersion: pkg.crossplane.io/v1
     kind: Function
     package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready
-    version: '>=v0.7.0'
+    version: '^v0'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-helm
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-kubernetes
-    version: '>=v1'
+    version: '^v1'
   description: Policy stack — Kyverno engine + Policy Reporter dashboard. Cloud-neutral.
     Other stacks (security, tenant) compose ClusterPolicy/CEL ValidatingPolicy resources
     against this engine.