diff --git a/.github/renovate.json b/.github/renovate.json
index 76006c79..3663c26b 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,53 +1,72 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.\n\nGenerated on 2024-12-16T14:24:07Z by kres f05fefd.\n\n",
+    "prHeader": "Update Request | Renovate Bot",
     "extends": [
+        ":dependencyDashboard",
+        ":gitSignOff",
         ":semanticCommitScopeDisabled",
         "schedule:earlyMondays"
     ],
-    "regexManagers": [
+    "customManagers": [
         {
+            "customType": "regex",
+            "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}",
             "fileMatch": [
                 "vars.yaml"
             ],
             "matchStrings": [
                 "# renovate: datasource=(?<datasource>.*?)(?:\\s+extractVersion=(?<extractVersion>.+?))?(?:\\s+versioning=(?<versioning>.+?))?\\s+depName=(?<depName>.+?)?\\s(?:.*_(?:version|VERSION):\\s+(?<currentValue>.*))?(?:(\\s)?.*_(?:ref|REF):\\s+(?<currentDigest>.*))?"
-            ],
-            "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+            ]
         },
         {
+            "customType": "regex",
+            "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}",
             "fileMatch": [
                 "Pkgfile"
             ],
             "matchStrings": [
                 "# renovate: datasource=(?<datasource>.*?)(?:\\s+extractVersion=(?<extractVersion>.+?))?(?:\\s+versioning=(?<versioning>.+?))?\\s+depName=(?<depName>.+?)?\\s(?:\\s+.*_(?:version|VERSION):\\s+(?<currentValue>.*))?(?:\\s.*_(?:ref|REF):\\s+(?<currentDigest>.*))?"
-            ],
-            "versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+            ]
         },
         {
+            "customType": "regex",
+            "datasourceTemplate": "github-tags",
+            "depNameTemplate": "siderolabs/bldr",
+            "versioningTemplate": "semver",
             "fileMatch": [
                 "Pkgfile"
             ],
             "matchStrings": [
                 "ghcr.io\\/siderolabs\\/bldr:(?<currentValue>v.*)"
-            ],
-            "depNameTemplate": "siderolabs/bldr",
-            "datasourceTemplate": "github-tags",
-            "versioningTemplate": "semver"
+            ]
         },
         {
+            "customType": "regex",
+            "datasourceTemplate": "github-tags",
+            "depNameTemplate": "siderolabs/bldr",
+            "versioningTemplate": "semver",
             "fileMatch": [
                 "Makefile"
             ],
             "matchStrings": [
                 "BLDR_RELEASE\\s+\\?=\\s+(?<currentValue>.*)\\n"
-            ],
-            "depNameTemplate": "siderolabs/bldr",
-            "datasourceTemplate": "github-tags",
-            "versioningTemplate": "semver"
+            ]
         }
     ],
     "packageRules": [
         {
+            "groupName": "dependencies",
+            "matchUpdateTypes": [
+                "major",
+                "minor",
+                "patch",
+                "pin",
+                "digest"
+            ]
+        },
+        {
+            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d+)?$",
             "matchPackageNames": [
                 "nvidia/open-gpu-kernel-modules",
                 "open-iscsi/open-isns",
@@ -55,69 +74,28 @@
                 "git://git.kernel.org/pub/scm/libs/libcap/libcap.git",
                 "git://sourceware.org/git/elfutils.git",
                 "git://git.kernel.org/pub/scm/utils/mdadm/mdadm.git"
-            ],
-            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d+)?$"
+            ]
         },
         {
+            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>[0-9]{1,3})?$",
             "matchPackageNames": [
                 "https://sourceware.org/git/glibc.git"
-            ],
-            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>[0-9]{1,3})?$"
+            ]
         },
         {
+            "versioning": "regex:^(?<major>\\d{4})(?<minor>\\d{2})(?<patch>\\d{2})\\.?(?<build>\\d+)?$",
             "matchPackageNames": [
                 "google/gvisor",
                 "intel/Intel-Linux-Processor-Microcode-Data-Files",
                 "cloudflare/cloudflared"
-            ],
-            "versioning": "regex:^(?<major>\\d{4})(?<minor>\\d{2})(?<patch>\\d{2})\\.?(?<build>\\d+)?$"
+            ]
         },
         {
+            "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-?(?<patch>\\d+)?$",
             "matchPackageNames": [
                 "git://linux-nfs.org/~steved/libtirpc"
-            ],
-            "versioning": "regex:^(?<major>\\d+)-(?<minor>\\d+)-?(?<patch>\\d+)?$"
-        },
-        {
-            "matchPackagePatterns": [
-                "*"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "groupName": "container images"
-        },
-        {
-            "matchPackagePatterns": [
-                "*"
-            ],
-            "matchDatasources": [
-                "go",
-                "golang-version"
-            ],
-            "groupName": "go packages"
-        },
-        {
-            "matchPackagePatterns": [
-                "*"
-            ],
-            "matchDatasources": [
-                "npm"
-            ],
-            "groupName": "node packages"
-        },
-        {
-            "matchPackagePatterns": [
-                "*"
-            ],
-            "matchDatasources": [
-                "git-refs",
-                "git-tags",
-                "github-tags",
-                "github-releases"
-            ],
-            "groupName": "releases"
+            ]
         }
     ],
-    "dependencyDashboard": true
+    "separateMajorMinor": false
 }
diff --git a/.kres.yaml b/.kres.yaml
index 82cce151..ee78d57d 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -167,3 +167,55 @@ spec:
           cosign verify $$image --certificate-identity-regexp '@siderolabs\.com$$' --certificate-oidc-issuer https://accounts.google.com || \
             cosign sign --yes $$image; \
         done
+---
+kind: common.Renovate
+spec:
+  customManagers:
+    - customType: regex
+      fileMatch:
+        - vars.yaml
+      matchStrings:
+        - '# renovate: datasource=(?<datasource>.*?)(?:\s+extractVersion=(?<extractVersion>.+?))?(?:\s+versioning=(?<versioning>.+?))?\s+depName=(?<depName>.+?)?\s(?:.*_(?:version|VERSION):\s+(?<currentValue>.*))?(?:(\s)?.*_(?:ref|REF):\s+(?<currentDigest>.*))?'
+      versioningTemplate: "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+    - customType: regex
+      fileMatch:
+        - Pkgfile
+      matchStrings:
+        - '# renovate: datasource=(?<datasource>.*?)(?:\s+extractVersion=(?<extractVersion>.+?))?(?:\s+versioning=(?<versioning>.+?))?\s+depName=(?<depName>.+?)?\s(?:\s+.*_(?:version|VERSION):\s+(?<currentValue>.*))?(?:\s.*_(?:ref|REF):\s+(?<currentDigest>.*))?'
+      versioningTemplate: "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
+    - customType: regex
+      fileMatch:
+        - Pkgfile
+      matchStrings:
+        - ghcr.io\/siderolabs\/bldr:(?<currentValue>v.*)
+      depNameTemplate: siderolabs/bldr
+      datasourceTemplate: github-tags
+      versioningTemplate: semver
+    - customType: regex
+      fileMatch:
+        - Makefile
+      matchStrings:
+        - BLDR_RELEASE\s+\?=\s+(?<currentValue>.*)\n
+      depNameTemplate: siderolabs/bldr
+      datasourceTemplate: github-tags
+      versioningTemplate: semver
+  packageRules:
+    - matchPackageNames:
+        - nvidia/open-gpu-kernel-modules
+        - open-iscsi/open-isns
+        - containers/crun
+        - git://git.kernel.org/pub/scm/libs/libcap/libcap.git
+        - git://sourceware.org/git/elfutils.git
+        - git://git.kernel.org/pub/scm/utils/mdadm/mdadm.git
+      versioning: 'regex:^(?<major>\d+)\.(?<minor>\d+)\.?(?<patch>\d+)?$'
+    - matchPackageNames:
+        - https://sourceware.org/git/glibc.git
+      versioning: 'regex:^(?<major>\d+)\.(?<minor>\d+)\.?(?<patch>[0-9]{1,3})?$'
+    - matchPackageNames:
+        - google/gvisor
+        - intel/Intel-Linux-Processor-Microcode-Data-Files
+        - cloudflare/cloudflared
+      versioning: 'regex:^(?<major>\d{4})(?<minor>\d{2})(?<patch>\d{2})\.?(?<build>\d+)?$'
+    - matchPackageNames:
+        - git://linux-nfs.org/~steved/libtirpc
+      versioning: 'regex:^(?<major>\d+)-(?<minor>\d+)-?(?<patch>\d+)?$'