diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 226097cd0..c40f35921 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,7 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended",
+    "config:best-practices",
+    "helpers:pinGitHubActionDigestsToSemver",
     "customManagers:dockerfileVersions" // used by logging-k8s-stdout-otlp-json/Dockerfile
   ],
   "packageRules": [