diff --git a/renovate.json b/renovate.json
index 4a0dbd4..c23016c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,18 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
   "semanticCommits": "enabled",
   "prConcurrentLimit": 2,
-  "rebaseWhen": "conflicted"
+  "rebaseWhen": "conflicted",
+  "packageRules": [
+    {
+      "description": "Do not pin internal monta-app GitHub Actions — these intentionally track @main",
+      "matchManagers": ["github-actions"],
+      "matchPackagePatterns": ["^monta-app/"],
+      "pinDigests": false
+    }
+  ]
 }