diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da7140bd..237679eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -131,3 +131,16 @@ jobs:
         BASE_SHA: ${{ github.event.pull_request.base.sha }}
       run: |
         scripts/perf-compare.sh "$BASE_SHA"
+
+  # The only check the ruleset requires, so jobs can change without touching repo settings.
+  ci-pass:
+    if: always()
+    needs:
+      - check-changelog
+      - frontend
+      - backend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if a required job failed or was cancelled
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
diff --git a/changelog/160.trivial.md b/changelog/160.trivial.md
new file mode 100644
index 00000000..2003d29a
--- /dev/null
+++ b/changelog/160.trivial.md
@@ -0,0 +1 @@
+Renovate now batches updates weekly and merges dev tooling, GitHub Actions and lockfile updates once CI passes.
diff --git a/renovate.json b/renovate.json
index 1dbee84b..d161ea6a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,44 +5,88 @@
     ":dependencyDashboard",
     ":semanticCommits"
   ],
+  "description": [
+    "Tooling and lockfile refreshes merge themselves once CI is green.",
+    "Runtime libraries, climate-ref, the interpreter, images and every major wait for a review."
+  ],
   "timezone": "Australia/Melbourne",
   "dependencyDashboardTitle": "Renovate Dependency Dashboard",
   "labels": ["dependencies"],
   "minimumReleaseAge": "3 days",
   "internalChecksFilter": "strict",
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 0,
+  "schedule": ["on monday"],
+  "platformAutomerge": false,
+  "automergeType": "pr",
   "lockFileMaintenance": {
     "enabled": true,
-    "schedule": ["before 6am on monday"]
+    "schedule": ["on monday"],
+    "automerge": true
   },
   "vulnerabilityAlerts": {
     "enabled": true,
-    "labels": ["dependencies", "security"]
+    "labels": ["dependencies", "security"],
+    "schedule": ["at any time"],
+    "minimumReleaseAge": null,
+    "groupName": null
   },
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
-      "description": "Label frontend (npm) updates",
       "matchManagers": ["npm"],
       "addLabels": ["frontend"]
     },
     {
-      "description": "Label backend (uv / Python) updates",
-      "matchManagers": ["pep621"],
+      "matchManagers": ["pep621", "pyenv"],
       "addLabels": ["backend"]
     },
     {
-      "description": "Group non-major frontend updates into a single PR",
       "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "frontend non-major"
+      "groupName": "frontend dependencies"
+    },
+    {
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["devDependencies"],
+      "groupName": "frontend dev tooling",
+      "automerge": true
     },
     {
-      "description": "Group non-major backend updates into a single PR",
       "matchManagers": ["pep621"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "backend non-major"
+      "groupName": "backend dependencies"
+    },
+    {
+      "matchManagers": ["pep621"],
+      "matchDepTypes": ["dependency-groups"],
+      "groupName": "backend dev tooling",
+      "automerge": true
+    },
+    {
+      "description": "The core library sets what the API can serve, so it is reviewed on its own",
+      "matchDepNames": ["climate-ref"],
+      "groupName": "climate-ref",
+      "schedule": ["at any time"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "ci tooling",
+      "automerge": true
+    },
+    {
+      "description": "Biome is pinned in both package.json and the CI workflow, so they move together",
+      "matchDepNames": ["@biomejs/biome", "biome"],
+      "groupName": "ci tooling",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "container images"
+    },
+    {
+      "description": "A major is never hidden inside a batch and never merges itself",
+      "matchUpdateTypes": ["major"],
+      "groupName": null,
+      "automerge": false
     }
   ]
 }