diff --git a/.github/renovate.json5 b/.github/renovate.json5
index e055052502f..0cdfdf83de0 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,9 +1,8 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: [
-    "config:recommended",
+    "config:best-practices",
     "docker:enableMajor",
-    "helpers:pinGitHubActionDigests",
     "security:openssf-scorecard",
     ":automergeBranch",
     ":automergeDigest",
@@ -22,19 +21,16 @@
   dependencyDashboardTitle: "Renovate Dashboard 🤖",
   suppressNotifications: ["prEditedNotification", "prIgnoreNotification"],
   "pre-commit": {
-    "enabled": true
+    enabled: true,
   },
-  ignorePaths: [
-    "**/*.enc.*",
-    "**/resources/**",
-  ],
+  ignorePaths: ["**/*.enc.*", "**/resources/**"],
   flux: {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
   "helm-values": {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
   kubernetes: {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
 }
diff --git a/kubernetes/apps/base/observability/grafana/app/helmrelease.yaml b/kubernetes/apps/base/observability/grafana/app/helmrelease.yaml
index a720a0dd898..153df471c94 100644
--- a/kubernetes/apps/base/observability/grafana/app/helmrelease.yaml
+++ b/kubernetes/apps/base/observability/grafana/app/helmrelease.yaml
@@ -11,7 +11,7 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 9.4.5
+    tag: 10.0.0@sha256:ab513c523e4a917a689d7c305eb6af02a31aabc15a307bdf870659e19535c749
   url: oci://ghcr.io/grafana/helm-charts/grafana
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json