diff --git a/.github/renovate.json b/.github/renovate.json
index 461adba5..e5eb94ee 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -6,15 +6,23 @@
     ":separateMultipleMajorReleases",
     "helpers:pinGitHubActionDigests"
   ],
-  "baseBranches": ["development"],
+  "baseBranchPatterns": [
+    "development"
+  ],
   "timezone": "UTC",
   "dependencyDashboard": true,
   "prConcurrentLimit": 10,
   "prHourlyLimit": 5,
-  "labels": ["dependencies"],
+  "labels": [
+    "dependencies"
+  ],
   "rebaseWhen": "conflicted",
-  "vulnerabilityAlerts": { "enabled": true },
-  "schedule": ["before 4am on Monday"],
+  "vulnerabilityAlerts": {
+    "enabled": true
+  },
+  "schedule": [
+    "before 4am on Monday"
+  ],
   "rangeStrategy": "bump",
   "automerge": true,
   "automergeType": "pr",
@@ -23,7 +31,9 @@
     {
       "customType": "regex",
       "description": "Track Go dependencies patched in Dockerfile for Caddy CVE fixes",
-      "fileMatch": ["^Dockerfile$"],
+      "managerFilePatterns": [
+        "/^Dockerfile$/"
+      ],
       "matchStrings": [
         "#\\s*renovate:\\s*datasource=go\\s+depName=(?<depName>[^\\s]+)\\s*\\n\\s*go get (?<depName2>[^@]+)@v(?<currentValue>[^\\s|]+)"
       ],
@@ -34,81 +44,160 @@
   "packageRules": [
     {
       "description": "Automerge digest updates (action pins, Docker SHAs)",
-      "matchUpdateTypes": ["digest", "pin"],
+      "matchUpdateTypes": [
+        "digest",
+        "pin"
+      ],
       "automerge": true
     },
     {
       "description": "Caddy transitive dependency patches in Dockerfile",
-      "matchManagers": ["regex"],
-      "matchFileNames": ["Dockerfile"],
-      "matchPackagePatterns": ["expr-lang/expr", "quic-go/quic-go", "smallstep/certificates"],
-      "labels": ["dependencies", "caddy-patch", "security"],
-      "automerge": true
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchFileNames": [
+        "Dockerfile"
+      ],
+      "labels": [
+        "dependencies",
+        "caddy-patch",
+        "security"
+      ],
+      "automerge": true,
+      "matchPackageNames": [
+        "/expr-lang/expr/",
+        "/quic-go/quic-go/",
+        "/smallstep/certificates/"
+      ]
     },
     {
       "description": "Automerge safe patch updates",
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": [
+        "patch"
+      ],
       "automerge": true
     },
     {
       "description": "Frontend npm: automerge minor for devDependencies",
-      "matchManagers": ["npm"],
-      "matchDepTypes": ["devDependencies"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": [
+        "npm"
+      ],
+      "matchDepTypes": [
+        "devDependencies"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "automerge": true,
-      "labels": ["dependencies", "npm"]
+      "labels": [
+        "dependencies",
+        "npm"
+      ]
     },
     {
       "description": "Backend Go modules",
-      "matchManagers": ["gomod"],
-      "labels": ["dependencies", "go"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": [
+        "gomod"
+      ],
+      "labels": [
+        "dependencies",
+        "go"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "automerge": true
     },
     {
       "description": "GitHub Actions updates",
-      "matchManagers": ["github-actions"],
-      "labels": ["dependencies", "github-actions"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": [
+        "github-actions"
+      ],
+      "labels": [
+        "dependencies",
+        "github-actions"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "automerge": true
     },
     {
       "description": "actions/checkout",
-      "matchManagers": ["github-actions"],
-      "matchPackageNames": ["actions/checkout"],
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchPackageNames": [
+        "actions/checkout"
+      ],
       "automerge": false,
-      "matchUpdateTypes": ["minor", "patch"],
-      "labels": ["dependencies", "github-actions", "manual-review"]
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "labels": [
+        "dependencies",
+        "github-actions",
+        "manual-review"
+      ]
     },
     {
       "description": "Do not auto-upgrade other github-actions majors without review",
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["major"],
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
       "automerge": false,
-      "labels": ["dependencies", "github-actions", "manual-review"],
+      "labels": [
+        "dependencies",
+        "github-actions",
+        "manual-review"
+      ],
       "prPriority": 0
     },
     {
       "description": "Docker: keep Caddy within v2 (no automatic jump to v3)",
-      "matchManagers": ["dockerfile"],
-      "matchPackageNames": ["caddy"],
+      "matchManagers": [
+        "dockerfile"
+      ],
+      "matchPackageNames": [
+        "caddy"
+      ],
       "allowedVersions": "<3.0.0",
-      "labels": ["dependencies", "docker"],
+      "labels": [
+        "dependencies",
+        "docker"
+      ],
       "automerge": true,
       "extractVersion": "^(?<version>\\d+\\.\\d+\\.\\d+)",
       "versioning": "semver"
     },
     {
       "description": "Group non-breaking npm minor/patch",
-      "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "groupName": "npm minor/patch",
       "prPriority": -1
     },
     {
       "description": "Group docker base minor/patch",
-      "matchManagers": ["dockerfile"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchManagers": [
+        "dockerfile"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
       "groupName": "docker base updates",
       "prPriority": -1
     }