diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml
index 7fcf677..3471b64 100644
--- a/.github/workflows/on-pr.yaml
+++ b/.github/workflows/on-pr.yaml
@@ -10,6 +10,7 @@ on:
       - reopened
       - synchronize
     paths:
+      - 'renovate.json'
       - '.github/workflows/on-pr.yaml'
       - 'apis/**'
       - 'examples/**'
diff --git a/examples/tenantstacks/standard.yaml b/examples/tenantstacks/standard.yaml
index e823267..ed715b7 100644
--- a/examples/tenantstacks/standard.yaml
+++ b/examples/tenantstacks/standard.yaml
@@ -10,4 +10,5 @@ spec:
     environment: dev
   capsule:
     namespace: capsule-system
+    # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts
     chartVersion: "0.12.4"
diff --git a/examples/tenantstacks/with-auth.yaml b/examples/tenantstacks/with-auth.yaml
index 6057313..25e1237 100644
--- a/examples/tenantstacks/with-auth.yaml
+++ b/examples/tenantstacks/with-auth.yaml
@@ -9,6 +9,7 @@ spec:
     team: platform
   capsule:
     namespace: capsule-system
+    # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts
     chartVersion: "0.12.4"
     proxy:
       enabled: true
diff --git a/functions/render/000-state-init.yaml.gotmpl b/functions/render/000-state-init.yaml.gotmpl
index 2b28bbc..560c2ad 100644
--- a/functions/render/000-state-init.yaml.gotmpl
+++ b/functions/render/000-state-init.yaml.gotmpl
@@ -49,6 +49,7 @@
 {{- end }}
 {{- $cpNamespace := $cp.namespace | default "capsule-system" }}
 {{- $cpReleaseName := $cp.releaseName | default "capsule" }}
+# renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts
 {{- $cpChartVersion := $cp.chartVersion | default "0.12.4" }}
 
 # ==============================================================================
@@ -60,6 +61,7 @@
   {{- $cpProxyEnabled = $cpProxy.enabled }}
 {{- end }}
 {{- $cpProxyReleaseName := $cpProxy.releaseName | default "capsule-proxy" }}
+# renovate: datasource=docker depName=projectcapsule/charts/capsule-proxy registryUrl=https://ghcr.io
 {{- $cpProxyChartVersion := $cpProxy.chartVersion | default "0.10.0" }}
 {{- $cpProxyUsernameClaim := $cpProxy.usernameClaim | default "sub" }}
 {{- $cpProxyReplicas := $cpProxy.replicas | default 1 }}
diff --git a/renovate.json b/renovate.json
index 820ceb8..85f0cfc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -12,27 +12,62 @@
   },
   "packageRules": [
     {
-      "description": "Automerge minor and patch updates that pass all checks",
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
+      "description": "Require manual merge until an e2e suite exists",
+      "matchUpdateTypes": [
+        "major",
+        "minor",
+        "patch"
+      ],
+      "automerge": false
     },
     {
       "description": "Disable automatic updates for all hops-ops Docker images",
-      "matchDatasources": ["docker"],
+      "matchDatasources": [
+        "docker"
+      ],
       "enabled": false,
-      "matchPackageNames": ["/^hops-ops//"]
+      "matchPackageNames": [
+        "/^hops-ops//"
+      ]
+    },
+    {
+      "description": "Group AWS provider-family packages",
+      "matchPackageNames": [
+        "/provider-family-aws/",
+        "/provider-aws-.*/"
+      ],
+      "groupName": "aws-providers"
     },
     {
       "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)",
-      "matchManagers": ["custom.regex"],
-      "matchDatasources": ["github-releases"],
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "github-releases"
+      ],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "deps"
+    },
+    {
+      "description": "Use feat(deps): commit prefix for hops-ops Crossplane packages (github-releases datasource)",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "github-releases"
+      ],
       "semanticCommitType": "feat",
       "semanticCommitScope": "deps"
     },
     {
       "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries",
-      "matchManagers": ["custom.regex"],
-      "matchDatasources": ["docker"],
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
       "semanticCommitType": "feat",
       "semanticCommitScope": "deps"
     }
@@ -41,30 +76,62 @@
     {
       "customType": "regex",
       "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "github-releases",
-      "packageNameTemplate": "hops-ops/{{depName}}"
+      "versioningTemplate": "npm",
+      "packageNameTemplate": "hops-ops/{{depName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "description": "Crossplane packages from other registries (tracked via Docker tags)",
+      "description": "Crossplane packages from xpkg registries (tracked via Docker tags)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>xpkg\\.[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "docker",
+      "versioningTemplate": "npm",
       "registryUrlTemplate": "https://{{registryUrl}}",
       "depNameTemplate": "{{orgName}}/{{repoName}}",
-      "packageNameTemplate": "{{orgName}}/{{repoName}}"
+      "packageNameTemplate": "{{orgName}}/{{repoName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
+    },
+    {
+      "customType": "regex",
+      "description": "Annotated runtime dependencies in schemas, templates, examples, and tests",
+      "managerFilePatterns": [
+        "apis/**/*.yaml",
+        "examples/**/*.yaml",
+        "functions/**/*.yaml.gotmpl",
+        "tests/**/*.k"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?<currentValue>v?[0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?<currentValue>v?[A-Za-z0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?<currentValue>[^\"]+)\""
+      ]
     }
+  ],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/__fixtures__/**",
+    "**/fixtures/**"
   ]
 }
diff --git a/tests/test-render/main.k b/tests/test-render/main.k
index 81c7087..3935dde 100644
--- a/tests/test-render/main.k
+++ b/tests/test-render/main.k
@@ -33,6 +33,7 @@ _items = [
                         chart = {
                             name = "capsule"
                             repository = "https://projectcapsule.github.io/charts"
+                            # renovate: datasource=helm depName=capsule registryUrl=https://projectcapsule.github.io/charts
                             version = "0.12.4"
                         }
                         namespace = "capsule-system"
@@ -242,6 +243,7 @@ _items = [
                         chart = {
                             name = "capsule-proxy"
                             repository = "oci://ghcr.io/projectcapsule/charts"
+                            # renovate: datasource=docker depName=projectcapsule/charts/capsule-proxy registryUrl=https://ghcr.io
                             version = "0.10.0"
                         }
                         namespace = "capsule-system"
diff --git a/upbound.yaml b/upbound.yaml
index baddd74..69520f8 100644
--- a/upbound.yaml
+++ b/upbound.yaml
@@ -7,23 +7,23 @@ spec:
   - apiVersion: pkg.crossplane.io/v1
     kind: Function
     package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready
-    version: '>=v0.7.0'
+    version: '^v0'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-helm
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-kubernetes
-    version: '>=v1'
+    version: '^v1'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-upjet-zitadel
-    version: '>=v0.1.1'
+    version: '^v0'
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-aws-eks
-    version: '>=v2'
+    version: '^v2'
   description: Tenant stack — Capsule (Kubernetes multi-tenancy) engine install. Cloud-neutral.
     First pass ships the Capsule controller helm release only; Tenant/Org claim XRDs,
     capsule-proxy, isolation tier enum, lifecycle states, CVE hardening and cross-stack