diff --git a/.github/renovate.json5 b/.github/renovate.json5
index e055052502f..0cdfdf83de0 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,9 +1,8 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: [
-    "config:recommended",
+    "config:best-practices",
     "docker:enableMajor",
-    "helpers:pinGitHubActionDigests",
     "security:openssf-scorecard",
     ":automergeBranch",
     ":automergeDigest",
@@ -22,19 +21,16 @@
   dependencyDashboardTitle: "Renovate Dashboard 🤖",
   suppressNotifications: ["prEditedNotification", "prIgnoreNotification"],
   "pre-commit": {
-    "enabled": true
+    enabled: true,
   },
-  ignorePaths: [
-    "**/*.enc.*",
-    "**/resources/**",
-  ],
+  ignorePaths: ["**/*.enc.*", "**/resources/**"],
   flux: {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
   "helm-values": {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
   kubernetes: {
-    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"]
+    managerFilePatterns: ["/(^|/)kubernetes/.+\\.ya?ml$/"],
   },
 }
diff --git a/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set-controller/app/helmrelease.yaml b/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set-controller/app/helmrelease.yaml
index 8e963731401..7d65f773b29 100644
--- a/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set-controller/app/helmrelease.yaml
+++ b/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set-controller/app/helmrelease.yaml
@@ -10,7 +10,7 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.12.1
+    tag: 0.12.1@sha256:621fb48c3fbf79cb817f03da35d19a26c35ad34de13e8cfa9816f9e462d2ce80
   url: oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json
diff --git a/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set/app/helmrelease.yaml b/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set/app/helmrelease.yaml
index 6a1709ef022..23a62677b78 100644
--- a/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set/app/helmrelease.yaml
+++ b/kubernetes/apps/base/actions-runner-system/gha-runner-scale-set/app/helmrelease.yaml
@@ -10,7 +10,7 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.12.1
+    tag: 0.12.1@sha256:97125addd369e3fd2838ff279fc685a83d7cfe7e29d56af435c7733633026d53
   url: oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json