diff --git a/.github/renovate.json b/.github/renovate.json
index 62bd7b3..4441164 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -76,6 +76,11 @@
       "matchUpdateTypes": ["patch", "digest"],
       "automerge": true
     },
+    {
+      "description": "A digest bump carries no version to gate on, and a ref-tracked dep is neither docker nor npm, so the rules above never reach either.",
+      "matchUpdateTypes": ["digest"],
+      "automerge": true
+    },
     {
       "description": "A minor here is a release line change, so review it.",
       "matchPackageNames": ["node", "python", "golang", "alpine"],