diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 39ddf8d..72c9645 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -12,7 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     # Pinned: a floating `latest` let a Renovate major change behaviour
     # unreviewed. Renovate bumps this pin itself (github-actions manager).
-    container: ghcr.io/renovatebot/renovate:44.171.1
+    # -full ships uv, node, python and the other tools Renovate runs to
+    # update lock files. The slim image downloads them per run, looking each
+    # version up on api.github.com: that spent the anonymous 60/h limit and
+    # failed the lock updates (artifactErrors).
+    container: ghcr.io/renovatebot/renovate:44.171.1-full
     steps:
       - uses: https://github.com/actions/checkout@v4
 
@@ -26,10 +30,11 @@ jobs:
           RENOVATE_ENDPOINT: http://git:3000/api/v1
           RENOVATE_REPOSITORIES: homelab/stack
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          # github.com lookups (github-tags/-releases pins, action pins, the
-          # uv/node tools Renovate installs to update lock files). Without it
-          # the anonymous 60/h API limit fails them all ("Package lookup
-          # failures", artifactErrors). A read-only token is enough.
+          RENOVATE_BINARY_SOURCE: global
+          # Optional. Without it, github.com lookups (github-tags/-releases
+          # pins) share the anonymous 60/h limit, which the -full image and
+          # fetchChangeLogs=off keep this repo well under. Add the secret (a
+          # no-scope classic PAT) for release notes and headroom.
           GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
           RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
           LOG_LEVEL: "info"
diff --git a/renovate.json b/renovate.json
index b71bcba..ff4d5f2 100644
--- a/renovate.json
+++ b/renovate.json
@@ -7,6 +7,7 @@
   "automergeStrategy": "fast-forward",
   "prHourlyLimit": 0,
   "minimumReleaseAge": "7 days",
+  "fetchChangeLogs": "off",
   "ignorePaths": [
     "**/node_modules/**",
     "**/bower_components/**",