diff --git a/.gitea/workflows/check-renovate.yml b/.gitea/workflows/check-renovate.yml.hold
similarity index 100%
rename from .gitea/workflows/check-renovate.yml
rename to .gitea/workflows/check-renovate.yml.hold
diff --git a/.gitea/workflows/renovate-pr-deploy.yml b/.gitea/workflows/renovate-pr-deploy.yml.hold
similarity index 100%
rename from .gitea/workflows/renovate-pr-deploy.yml
rename to .gitea/workflows/renovate-pr-deploy.yml.hold
diff --git a/renovate.json b/renovate.json
index 7c82874a..b8952a1f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -15,37 +15,43 @@
   ],
   "packageRules": [
     {
-      "matchCategories": [
-        "docker"
-      ],
-      "enabled": true
+      "description": "Pin ClickHouse to the exact version used by Signoz",
+      "matchPackageNames": ["clickhouse/clickhouse-server"],
+      "allowedVersions": "^24\\.1\\.2-alpine$",
+      "groupName": "signoz-clickhouse",
+      "semanticCommitScope": "signoz-clickhouse"
     },
     {
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchPackageNames": [
-        "clickhouse/clickhouse-server"
-      ],
-      "enabled": false
+      "description": "Allow only Alpine tag upgrades for all Alpine-based images",
+      "matchDatasources": ["docker"],
+      "matchPackagePatterns": [".*alpine.*"],
+      "allowedVersions": ".*alpine.*",
+      "groupName": "alpine-upgrades",
+      "semanticCommitScope": "{{depName}}"
     },
     {
-      "matchDatasources": [
-        "docker"
-      ],
-      "allowedVersions": "/.*-alpine$/",
-      "matchPackageNames": [
-        "/.*-alpine$/"
-      ]
+      "description": "Pin postgres image – never upgrade",
+      "matchPackageNames": ["postgres"],
+      "pin": true,
+      "semanticCommitScope": "postgres"
     },
     {
-      "matchDatasources": [
-        "docker"
-      ],
-      "enabled": false,
-      "matchPackageNames": [
-        "/^.*:latest$/"
-      ]
+      "description": "Pin pgvector image – never upgrade",
+      "matchPackageNames": ["pgvector/pgvector"],
+      "pin": true,
+      "semanticCommitScope": "pgvector"
+    },
+    {
+      "description": "Pin pgvecto‑rs image – never upgrade",
+      "matchPackageNames": ["pgvecto-rs/pgvecto-rs"],
+      "pin": true,
+      "semanticCommitScope": "pgvecto-rs"
+    },
+    {
+      "description": "Default rule for all remaining Docker images",
+      "matchDatasources": ["docker"],
+      "groupName": "docker-images",
+      "semanticCommitScope": "{{depName}}"
     }
   ],
   "customManagers": [],