diff --git a/dev/scripts/backends/gitea.py b/dev/scripts/backends/gitea.py
index 977d626..2a4e81e 100644
--- a/dev/scripts/backends/gitea.py
+++ b/dev/scripts/backends/gitea.py
@@ -18,9 +18,9 @@ from backends.github import (
 # tools that guard the supply chain an unpinned dependency themselves.
 # Renovate bumps these via the regex manager in renovate.json; re-run
 # gen_config.py after a bump.
-# renovate: datasource=github-releases depName=aquasecurity/trivy
+# renovate: datasource=docker depName=aquasec/trivy
 TRIVY_VERSION = "0.76.0"
-# renovate: datasource=github-releases depName=google/go-containerregistry
+# renovate: datasource=docker depName=gcr.io/go-containerregistry/crane
 CRANE_VERSION = "0.22.1"
 
 # ── Override action refs with full GitHub URLs ───────────────────
diff --git a/infra/images/zotero.Dockerfile b/infra/images/zotero.Dockerfile
index 8a2a731..5903b89 100644
--- a/infra/images/zotero.Dockerfile
+++ b/infra/images/zotero.Dockerfile
@@ -29,7 +29,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Reinstall yq as a current static binary (replaces the vulnerable base copy
 # purged above). KasmVNC's entrypoint hard-depends on it (mikefarah v4 syntax);
 # a recent release carries the patched Go stdlib that motivated the removal.
-# renovate: datasource=github-releases depName=mikefarah/yq extractVersion=^v(?<version>.+)$
+# renovate: datasource=docker depName=mikefarah/yq
 ARG YQ_VERSION=4.53.3
 RUN arch="$(dpkg --print-architecture)" \
     && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${arch}" -o /usr/bin/yq \
@@ -57,7 +57,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # default (the guard only emits when OTEL_EXPORTER_OTLP_ENDPOINT is set and
 # this container is attached to the `observability` network — see compose.yml).
 # Best-effort install so a release-asset hiccup never breaks the image build.
-# renovate: datasource=github-releases depName=equinix-labs/otel-cli extractVersion=^v(?<version>.+)$
+# renovate: datasource=docker depName=ghcr.io/equinix-labs/otel-cli extractVersion=^v(?<version>.+)$
 ARG OTEL_CLI_VERSION=0.4.5
 RUN arch="$(dpkg --print-architecture | sed -e 's/amd64/amd64/' -e 's/arm64/arm64/')" \
     && curl -fsSL "https://github.com/equinix-labs/otel-cli/releases/download/v${OTEL_CLI_VERSION}/otel-cli_${OTEL_CLI_VERSION}_linux_${arch}.tar.gz" \
diff --git a/renovate.json b/renovate.json
index ff4d5f2..ee051ca 100644
--- a/renovate.json
+++ b/renovate.json
@@ -42,6 +42,18 @@
       "matchPackageNames": ["pymupdf"],
       "allowedVersions": "<2"
     },
+    {
+      "description": "Action pins (uses: …@v4) are github-tags lookups, which Renovate refuses without a GITHUB_COM_TOKEN; and all workflows but renovate.yml are generated by gen_config.py from dev/scripts/backends/*.py, so a direct edit would fail its --check. The Renovate container image (docker datasource) stays tracked.",
+      "matchManagers": ["github-actions"],
+      "matchDatasources": ["github-tags"],
+      "enabled": false
+    },
+    {
+      "description": "requires-python is a support floor, not a dependency to bump.",
+      "matchManagers": ["pep621"],
+      "matchDepNames": ["python"],
+      "enabled": false
+    },
     {
       "description": "Every service shares the same .duckdb files; a new duckdb major is a coordinated migration, not a bump (see pyproject's notebooks extra).",
       "matchPackageNames": ["duckdb"],
@@ -62,14 +74,10 @@
   "dockerfile": {
     "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
   },
-  "github-actions": {
-    "description": "Only the hand-written Renovate workflow; the rest of .gitea/workflows is generated by gen_config.py.",
-    "managerFilePatterns": ["/^\\.gitea/workflows/renovate\\.yml$/"]
-  },
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (marimo, yq, otel-cli, …) that the dockerfile manager can't see.",
+      "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (yq, otel-cli, …) that the dockerfile manager can't see. Tools that publish a Docker image are tracked through it (datasource=docker): github-* datasources need a GITHUB_COM_TOKEN.",
       "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"