diff --git a/renovate.json5 b/renovate.json5
index 83b5fc1..2711d4f 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -47,11 +47,15 @@
     "enabled": true,
     "addLabels": ["security"],
     "schedule": ["at any time"],
-    "automerge": true,
-    "matchConfidence": ["high", "very high"]
   },
 
   "packageRules": [
+    {
+      "description": "Auto-merge high-confidence security updates",
+      "matchCategories": ["security"],
+      "matchConfidence": ["high", "very high"],
+      "automerge": true
+    },
     {
       "description": "Skip internal reusable workflows and actions",
       "matchManagers": ["github-actions"],