diff --git a/.release-please/main-manifest.json b/.release-please/main-manifest.json
index 8032c17..38acea6 100644
--- a/.release-please/main-manifest.json
+++ b/.release-please/main-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.12.0"
+  ".": "0.12.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f48bbfc..f6dc846 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project are documented here, generated by
 [release-please](https://github.com/googleapis/release-please) from
 [Conventional Commits](https://www.conventionalcommits.org).
 
+## [0.12.1](https://github.com/taraxvoid/voidflow/compare/v0.12.0...v0.12.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **renovate:** drop Renovate security PRs in favor of Dependabot security updates ([#124](https://github.com/taraxvoid/voidflow/issues/124)) ([63a1b6f](https://github.com/taraxvoid/voidflow/commit/63a1b6f3a7827a9292f27f27468da6bb8e802c37))
+
 ## [0.12.0](https://github.com/taraxvoid/voidflow/compare/v0.11.1...v0.12.0) (2026-10-06)
 
 
diff --git a/README.md b/README.md
index b947dde..c718799 100644
--- a/README.md
+++ b/README.md
@@ -222,8 +222,17 @@ scripts: define `test:unit:precommit` (for example excluding tests that need a
 built `dist/`) and the pre-commit unit step runs it instead of `test:unit`.
 
 Install the binary through mise (`lefthook = "<version>"` in `mise.toml`) and
-set `"prepare": "lefthook install"` so `bun install` wires the hooks. `ref`
-cannot be a commit SHA; pin a release tag.
+set the `prepare` script so `bun install` wires the hooks, but make it tolerate a
+missing binary:
+
+```json
+"prepare": "lefthook install || echo 'lefthook not installed (run mise install); git hooks skipped'"
+```
+
+A bare `lefthook install` fails the whole install step (exit 127) on any runner
+without the `lefthook` binary, which includes GitHub-hosted and self-hosted CI
+images, and CI never runs git hooks anyway. `ref` cannot be a commit SHA; pin a
+release tag.
 
 ## Branch rulesets as code
 
diff --git a/default.json b/default.json
index 003e4e0..a0dab61 100644
--- a/default.json
+++ b/default.json
@@ -15,9 +15,7 @@
     "schedule": ["before 9am on the first day of the month"]
   },
   "vulnerabilityAlerts": {
-    "minimumReleaseAge": null,
-    "schedule": ["at any time"],
-    "labels": ["security"]
+    "enabled": false
   },
   "packageRules": [
     {