diff --git a/default.json b/default.json
index bb73ba9..b1fcaf5 100644
--- a/default.json
+++ b/default.json
@@ -381,6 +381,17 @@
         "#\\s*renovate:\\s*datasource=(?<datasource>[a-z-]+)\\s+depName=(?<depName>[^\\s]+)(\\s+versioning=(?<versioning>[a-z-]+))?\\nARG\\s+\\w+=(?<currentValue>\\S+)"
       ]
     },
+    {
+      "customType": "regex",
+      "description": "Dockerfile *_COMMIT pins that track a BRANCH of a tagless git repo (`branch=` marker): a `# renovate: datasource=git-refs depName=<short> packageName=<repo url> branch=<ref>` comment followed directly by an ARG *_COMMIT=<40-hex> line. This is the git-refs datasource's documented digest mode — the named ref goes in currentValue and the commit is matched as currentDigest — so Renovate resolves that branch's head itself and rewrites the ARG. Use it for upstreams that publish NO tags and no versioned artifact, where the commit is the only identifier the project offers: subflux's libx264 (code.videolan.org/videolan/x264 has zero tags, only master/stable/GPLv2-only, and VideoLAN's versioned snapshot tarballs stopped in 2019-12), for which the pin had silently sat 26 months and 31 commits behind `stable` because no manager could see it. Distinct from the two neighbouring commit-pin conventions and mutually exclusive with both: the generic ARG manager above requires ARG on the line immediately after depName, so the `packageName=` token locks it out; the `digest=commit` manager below needs datasource=github-tags plus that marker token and resolves a TAG to its commit, which a tagless repo cannot offer. Also outside repin-sha.sh's postUpgradeTasks scope, which recomputes the sha256 of an artifact a VERSION names — here there is no version and no sha256, and Renovate supplies the new commit directly. Digest updates auto-merge under the routine-update-types rule at the top of this file; add a matchDepNames automerge=false rule (the git-cliff / tool-registry digest alarms are the pattern) for any pin whose upstream branch should get a human glance first. re2-safe. A no-op in every repo without a `branch=` marker.",
+      "managerFilePatterns": [
+        "/Dockerfile$/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=git-refs\\s+depName=(?<depName>\\S+)\\s+packageName=(?<packageName>\\S+)\\s+branch=(?<currentValue>\\S+)\\s*\\nARG\\s+\\w+_COMMIT=(?<currentDigest>[a-f0-9]{40})"
+      ],
+      "datasourceTemplate": "git-refs"
+    },
     {
       "customType": "regex",
       "description": "Dockerfile tag+commit pin pairs (`digest=commit` marker): a `# renovate: datasource=github-tags depName=... digest=commit` comment followed by an ARG *_REF=<tag> line and an ARG *_COMMIT=<sha> line. currentValue is the tag, currentDigest the commit it dereferences to; github-tags resolves both on every bump (annotated tags dereference to the commit oid), so the pair auto-updates with no manual step — the Dockerfile fetches BY COMMIT (codeload.github.com/<owner>/<repo>/tar.gz/<commit>), making git content addressing the integrity anchor. Use this for any codeload/repo-tarball pin: no digest datasource exists for those tarballs and their bytes are not stable enough to hash (the retired mise/aqua manual-sha-bump model learned both the hard way; those pins have since moved out of the app images entirely — cplieger/tool-catalog publishes the compiled artifact — leaving this Dockerfile shape with no current consumers, while the registries.env manager below is the same convention with a live consumer; pattern reference: ci-renovate.md). The `digest=commit` marker doubles as the mutual-exclusion token: the generic ARG manager above requires ARG immediately after depName/versioning, so it can never double-match these blocks, and this manager requires the marker so it can never match plain ARG pins. re2-safe (no lookaround).",