diff --git a/renovate.json b/renovate.json
index f7c7970d07e..f44cc12b7cb 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,5 +1,5 @@
 {
-  "extends": ["config:recommended"],
+  "extends": ["config:best-practices", "helpers:pinGitHubActionDigestsToSemver"],
   "packageRules": [
     {
       "groupName": "all patch versions",