diff --git a/default.json b/default.json
index 3ddfd1b..8de2d22 100644
--- a/default.json
+++ b/default.json
@@ -6,7 +6,6 @@
     ":automergeDigest",
     ":automergePatch",
     ":automergeRequireAllStatusChecks",
-    "customManagers:githubActionsVersions",
     "default:semanticCommits",
     "default:prHourlyLimitNone",
     "default:prConcurrentLimit10",
@@ -48,20 +47,6 @@
     "dependencyDashboardApproval": true
   },
   "versioning": "docker",
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Handle Docker images with optional digest (e.g. :tag or :tag@sha256:...)",
-      "fileMatch": ["(^|/)docker-compose.*\\.ya?ml$"],
-      "matchStrings": [
-        "image:\\s*(?<depName>[\\w./-]+):(?<currentTag>[\\w.-]+)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?"
-      ],
-      "datasourceTemplate": "docker",
-      "versioningTemplate": "loose",
-      "extractVersionTemplate": "{{currentTag}}",
-      "extractDigestTemplate": "{{#if currentDigest}}{{currentDigest}}{{/if}}"
-    }
-  ],
   "packageRules": [
     {
       "description": "Alpine-based images only update to Alpine-based versions",
@@ -72,22 +57,79 @@
       "allowedVersions": "/alpine/i"
     },
     {
-      "description": "Replace :stable with digest only",
+      "description": "Replace :latest with semver tag + digest",
+      "matchDatasources": ["docker"],
+      "matchManagers": ["docker-compose"],
+      "matchCurrentValue": "latest",
+      "versioning": "docker",
+      "pinDigests": true
+    },
+    {
+      "description": "Replace :latest with semver tag + digest",
+      "matchDatasources": ["docker"],
+      "matchManagers": ["docker-compose"],
+      "matchCurrentValue": "master",
+      "versioning": "docker",
+      "pinDigests": true
+    },
+    {
+      "description": "Replace :stable with semver tag + digest",
       "matchDatasources": ["docker"],
       "matchManagers": ["docker-compose"],
       "matchCurrentValue": "stable",
       "versioning": "docker",
       "pinDigests": true
+    }
+  ],
+  "customManagers": [
+    {
+      "description": "Update flarectl version in workflows",
+      "fileMatch": [
+        ".github/workflows/.*\\.ya?ml$",
+        ".gitea/workflows/.*\\.ya?ml$"
+      ],
+      "matchStrings": ["FLARECTL_VERSION: \\\"(?<currentValue>.*?)\\\""],
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "cloudflare/cloudflare-go",
+      "versioningTemplate": "semver",
+      "extractVersionTemplate": "^v?(?<version>.*)$",
+      "allowedVersions": "/^v?0\\..*/"
     },
     {
-      "description": "Ignore self-hosted actions",
-      "matchManagers": ["github-actions"],
-      "matchPackageNames": [
-        "Trez/hc-vault-env",
-        "Trez/docker-select-image-pull",
-        "Trez/gitea-auto-pr"
+      "description": "Update Vault version in workflows",
+      "fileMatch": [
+        ".github/workflows/.*\\.ya?ml$",
+        ".gitea/workflows/.*\\.ya?ml$"
       ],
-      "enabled": false
+      "matchStrings": ["HC_VAULT_VERSION: \\\"(?<currentValue>.*?)\\\""],
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "hashicorp/vault",
+      "versioningTemplate": "semver",
+      "extractVersionTemplate": "^v?(?<version>.*)$"
+    },
+    {
+      "description": "Update tea CLI version in workflows",
+      "fileMatch": [
+        ".github/workflows/.*\\.ya?ml$",
+        ".gitea/workflows/.*\\.ya?ml$"
+      ],
+      "matchStrings": ["TEA_VERSION: \\\"(?<currentValue>.*?)\\\""],
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "go-gitea/tea",
+      "versioningTemplate": "semver",
+      "extractVersionTemplate": "^v?(?<version>.*)$"
+    },
+    {
+      "description": "Update Renovate version in workflows",
+      "fileMatch": [
+        ".github/workflows/.*\\.ya?ml$",
+        ".gitea/workflows/.*\\.ya?ml$"
+      ],
+      "matchStrings": ["RENOVATE_VERSION: \\\"(?<currentValue>.*?)\\\""],
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "renovatebot/renovate",
+      "versioningTemplate": "semver",
+      "extractVersionTemplate": "^v?(?<version>.*)$"
     }
   ]
 }