diff --git a/renovate-config.js b/renovate-config.js
index 0091014..2830bb7 100644
--- a/renovate-config.js
+++ b/renovate-config.js
@@ -39,5 +39,16 @@ module.exports = {
       ],
       pinDigests: true,
     },
+    {
+      // pin/pinDigest/digest updates have no release timestamp, so
+      // minimumReleaseAge can never be satisfied and its stability check
+      // would leave those PRs pending forever.
+      // https://github.com/renovatebot/renovate/issues/40288
+      matchUpdateTypes: ['pin', 'pinDigest', 'digest'],
+      minimumReleaseAge: null,
+      prBodyNotes: [
+        '**Manual supply-chain check:** `minimumReleaseAge` cannot be enforced for pin/digest updates because they have no release timestamp. Before merging, confirm this commit SHA has been published for at least **2 days**.',
+      ],
+    },
   ],
 };