diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 9386de6f4d08..000000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: daily
-      time: "06:00"
-    open-pull-requests-limit: 10
-    labels:
-      - dependency
-      - github_actions
-    cooldown:
-      default-days: 7
-    groups:
-      codeql-action:
-        patterns:
-          - "github/codeql-action/*"
-    ignore:
-      # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
-      - dependency-name: "github/gh-aw-actions/**"
-      - dependency-name: "github/gh-aw-actions"
diff --git a/.github/renovate.json b/.github/renovate.json
index ff8501778252..05657543aa15 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -9,6 +9,7 @@
     "dockerfile",
     "npm",
     "custom.regex",
+    "github-actions",
     "homeassistant-manifest"
   ],
 
@@ -55,7 +56,7 @@
   ],
 
   "minimumReleaseAge": "7 days",
-  "prConcurrentLimit": 10,
+  "prConcurrentLimit": 0,
   "prHourlyLimit": 2,
   "schedule": ["before 6am"],
 
@@ -183,6 +184,22 @@
       "enabled": true,
       "labels": ["dependency"]
     },
+    {
+      "description": "GitHub Actions used in our workflows (allowlisted). Runner labels and action version inputs are deliberately left out.",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action", "workflow", "docker", "container", "service"],
+      "enabled": true,
+      "labels": ["dependency", "github_actions"]
+    },
+    {
+      "description": "Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.",
+      "matchPackageNames": [
+        "github/gh-aw-actions",
+        "/^github\\/gh-aw-actions\\//",
+        "/^ghcr\\.io\\/github\\/gh-aw/"
+      ],
+      "enabled": false
+    },
     {
       "description": "pnpm version pinned in the E2E tests packageManager field (allowlisted)",
       "matchManagers": ["npm"],
@@ -192,6 +209,14 @@
       "enabled": true,
       "labels": ["dependency"]
     },
+    {
+      "description": "Playwright pinned in the E2E tests (allowlisted)",
+      "matchManagers": ["npm"],
+      "matchFileNames": ["tests/e2e/package.json"],
+      "matchPackageNames": ["@playwright/test"],
+      "enabled": true,
+      "labels": ["dependency"]
+    },
     {
       "description": "For types-* stubs, only allow patch updates. Major/minor bumps track the upstream runtime package version and must be manually coordinated with the corresponding pin.",
       "matchPackageNames": ["/^types-/"],
@@ -247,6 +272,18 @@
       "groupName": "pylint",
       "groupSlug": "pylint"
     },
+    {
+      "description": "Group the github/codeql-action subactions into one PR (they share a release)",
+      "matchPackageNames": ["/^github\\/codeql-action(?:\\/|$)/"],
+      "groupName": "github/codeql-action",
+      "groupSlug": "codeql-action"
+    },
+    {
+      "description": "Group the actions/cache subactions into one PR (they share a release)",
+      "matchPackageNames": ["/^actions\\/cache(?:\\/|$)/"],
+      "groupName": "actions/cache",
+      "groupSlug": "actions-cache"
+    },
     {
       "description": "Group go2rtc Dockerfile pin with const.py RECOMMENDED_VERSION into one PR",
       "matchPackageNames": ["ghcr.io/alexxit/go2rtc"],