diff --git a/.github/renovate.json5 b/.github/renovate.json5
index bb5d4c2921..af04b2d5d0 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -22,6 +22,13 @@
       "schedule": ["* 0-7 * * 2"], // weekly, before 8am on Tuesday
       "groupName": "github actions"
     },
+    {
+      // keep Kotlin Gradle plugin updates out of the catch-all patch PR because CodeQL often
+      // fails on them, which blocks unrelated patch updates
+      "matchDepNames": ["org.jetbrains.kotlin.jvm"],
+      "schedule": ["* 0-7 * * 2"], // weekly, before 8am on Tuesday
+      "groupName": "kotlin plugin updates"
+    },
 
     // ── Version constraints ────────────────────────────────────────────