diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 3b8dbf74e..2ae6a4384 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -28,6 +28,11 @@
       "matchPackagePrefixes": ["com.gradle.enterprise"],
       "groupName": "gradle enterprise packages"
     },
+    {
+      // prevent 3.0.1u2 -> 3.0.1
+      "matchPackageNames": ["com.google.code.findbugs:annotations"],
+      "allowedVersions": "!/^3\\.0\\.1$/"
+    },
     {
       // disruptor 4+ requires Java 11+
       "matchPackageNames": ["com.lmax:disruptor"],