diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index ea6dcb12e590..195de9d3810a 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -46,7 +46,7 @@ jobs:
                   f.write(f"value={json.dumps(value)}\n")
 
       - name: Run Renovate
-        uses: renovatebot/github-action@3064367f740a1a91cca218698a63902689cce200
+        uses: renovatebot/github-action@266fef21329c44765ad42f9dea1f01f5d2d91084 # v46.3.13
         env:
           RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
           RENOVATE_FORCE: ${{ steps.force.outputs.value }}
diff --git a/renovate.json b/renovate.json
index 59d65335676a..1e3afabb9403 100644
--- a/renovate.json
+++ b/renovate.json
@@ -12,6 +12,12 @@
     "enabled": true,
     "schedule": ["before 9am on monday"]
   },
+  "pep621": {
+    "lockFileMaintenance": {
+      "description": "Not needed for uv, as Renovate remediates vulnerable transitive uv.lock dependencies directly",
+      "enabled": false
+    }
+  },
   "packageRules": [
     {
       "matchManagers": ["pep621"],
@@ -50,7 +56,8 @@
       "rangeStrategy": "bump"
     },
     {
-      "description": "Re-enable lock file maintenance, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.",
+      "description": "Re-enable lock file maintenance for npm, which security:only-security-updates disables. Keep last with an empty scope to ensure commit scope is applied correctly.",
+      "matchManagers": ["npm"],
       "matchUpdateTypes": ["lockFileMaintenance"],
       "enabled": true,
       "semanticCommitScope": ""