diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 68ff51773..8425f52fc 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,6 +1,6 @@
 {
   "extends": [
-    "config:best-practices",
+    "config:recommended",
     "replacements:k8s-registry-move",
     ":automergeBranch",
     ":disableRateLimiting",
diff --git a/.github/renovate/autoMerge.json5 b/.github/renovate/autoMerge.json5
index a0114ad4b..f3f7f5be1 100644
--- a/.github/renovate/autoMerge.json5
+++ b/.github/renovate/autoMerge.json5
@@ -2,20 +2,59 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "packageRules": [
     {
-      "description": "Auto-merge container digests updates for trusted containers",
+      "description": "Auto-merge trusted container digests",
       "matchDatasources": ["docker"],
       "automerge": true,
-      "automergeType": "branch",
+      "automergeType": "pr",
       "matchUpdateTypes": ["digest"],
-      "matchPackagePatterns": ["ghcr.io/auricom", "ghcr.io/bjw-s", "ghcr.io/home-operations", "cgr.dev/chainguard"]
+      "matchPackagePatterns": [
+        "ghcr.io/auricom",
+        "ghcr.io/bjw-s",
+        "ghcr.io/home-operations",
+        "cgr.dev/chainguard"
+      ],
+      "ignoreTests": false
     },
     {
-      "description": "Auto-merge GitHub Actions for minor and patch",
+      "description": "Auto-merge OCI Charts",
+      "matchDatasources": ["docker"],
+      "automerge": true,
+      "automergeType": "pr",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchPackageNames": ["/kube-prometheus-stack/"],
+      "ignoreTests": false
+    },
+    {
+      "description": "Auto-merge GitHub Actions",
       "matchManagers": ["github-actions"],
-      "matchDatasources": ["github-tags"],
       "automerge": true,
       "automergeType": "branch",
-      "matchUpdateTypes": ["minor", "patch"]
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "minimumReleaseAge": "3 days",
+      "ignoreTests": true
+    },
+    {
+      "description": "Auto-merge trusted GitHub Actions",
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["/^actions\//"],
+      "automerge": true,
+      "automergeType": "branch",
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "minimumReleaseAge": "1 minute",
+      "ignoreTests": true
+    },
+    {
+      "description": "Auto-merge GitHub Releases",
+      "matchDatasources": ["github-releases"],
+      "automerge": true,
+      "automergeType": "branch",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchPackageNames": [
+        "/external-dns/",
+        "/gateway-api/",
+        "/prometheus-operator/"
+      ],
+      "ignoreTests": true
     }
   ]
 }
diff --git a/.github/renovate/customManagers.json5 b/.github/renovate/customManagers.json5
index d096a07e6..5ec4089df 100644
--- a/.github/renovate/customManagers.json5
+++ b/.github/renovate/customManagers.json5
@@ -3,36 +3,25 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Process custom dependencies",
+      "description": "Process annotated dependencies",
       "fileMatch": [
-        "(^|/)ansible/.+\\.ya?ml(\\.j2)?$",
-        "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?$"
+        "(^|/).+\\.env$",
+        "(^|/).+\\.sh$",
+        "(^|/).+\\.ya?ml(?:\\.j2)?$"
       ],
       "matchStrings": [
-        // Example: `k3s_release_version: "v1.27.3+k3s1"`
-        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?\n.*?\"(?<currentValue>.*)\"\n",
-        // Example: `- https://github.com/rancher/system-upgrade-controller/releases/download/v0.11.0/crd.yaml`
-        //          `- https://github.com/argoproj/argo-cd/raw/v2.7.10/manifests/install.yaml`
-        //          `- https://github.com/argoproj/argo-cd/raw/v2.7.10/manifests/ha/install.yaml`
-        //          `- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/21.1.1/kubernetes/kubernetes.yml`
-        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?\n.*?-\\s(.*?)\/(?<currentValue>(v|\\d)[^/]+)\/\\S+\n",
-        // Example: apiVersion=helm.cattle.io/v1 kind=HelmChart
-        "datasource=(?<datasource>\\S+)\n.*?repo: (?<registryUrl>\\S+)\n.*?chart: (?<depName>\\S+)\n.*?version: (?<currentValue>\\S+)\n"
+        // # renovate: datasource=github-releases depName=k3s-io/k3s
+        // k3s_release_version: &version v1.29.0+k3s1
+        // # renovate: datasource=helm depName=cilium repository=https://helm.cilium.io
+        // version: 1.15.1
+        // # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+        // KUBERNETES_VERSION=v1.31.1
+        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( repository=(?<registryUrl>\\S+))?\\n.+(:\\s|=)(&\\S+\\s)?(?<currentValue>\\S+)",
+        // # renovate: datasource=docker depName=ghcr.io/prometheus-operator/prometheus-operator
+        // https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.80.0/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagerconfigs.yaml
+        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\n.+/(?<currentValue>(v|\\d)[^/]+)"
       ],
-      "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}github-releases{{/if}}",
-      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
-    },
-    {
-      "customType": "regex",
-      "description": "Process CloudnativePG Postgresql version",
-      "fileMatch": [
-        "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?$"
-      ],
-      "matchStrings": [
-        "imageName: (?<depName>\\S+):(?<currentValue>.*\\-.*)"
-      ],
-      "datasourceTemplate": "docker",
-      "versioningTemplate": "redhat"
+      "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}github-releases{{/if}}"
     }
   ]
 }
diff --git a/.github/renovate/grafanaDashboards.json5 b/.github/renovate/grafanaDashboards.json5
index 68799ebfc..5085bc1f8 100644
--- a/.github/renovate/grafanaDashboards.json5
+++ b/.github/renovate/grafanaDashboards.json5
@@ -11,11 +11,9 @@
   },
   "customManagers": [
     {
+      "description": "Process Grafana dashboards",
       "customType": "regex",
-      "description": ["Process Grafana dashboards"],
-      "fileMatch": [
-        "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
-      ],
+      "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml$"],
       "matchStrings": [
         "depName=\"(?<depName>.*)\"\\n(?<indentation>\\s+)gnetId: (?<packageName>\\d+)\\n.+revision: (?<currentValue>\\d+)"
       ],
@@ -27,12 +25,15 @@
   "packageRules": [
     {
       "addLabels": ["renovate/grafana-dashboard"],
+      "automerge": true,
+      "automergeType": "branch",
+      "commitMessageExtra": "({{currentVersion}} → {{newVersion}})",
+      "commitMessageTopic": "dashboard {{depName}}",
+      "ignoreTests": true,
       "matchDatasources": ["custom.grafana-dashboards"],
       "matchUpdateTypes": ["major"],
-      "semanticCommitType": "chore",
       "semanticCommitScope": "grafana-dashboards",
-      "commitMessageTopic": "dashboard {{depName}}",
-      "commitMessageExtra": "( {{currentVersion}} → {{newVersion}} )"
+      "semanticCommitType": "chore"
     }
   ]
 }
diff --git a/.github/renovate/groups.json5 b/.github/renovate/groups.json5
index 833fc7044..0aa080ba2 100644
--- a/.github/renovate/groups.json5
+++ b/.github/renovate/groups.json5
@@ -24,6 +24,24 @@
       },
       "separateMinorPatch": true
     },
+    {
+      "description": "Cert-Manager Group",
+      "groupName": "Cert-Manager",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/cert-manager/"],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      }
+    },
+    {
+      "description": "Cilium Group",
+      "groupName": "Cilium",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/cilium/"],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      }
+    },
     {
       "description": ["Dragonfly Operator Group"],
       "groupName": "Dragonfly Operator",
@@ -35,25 +53,43 @@
       "separateMinorPatch": true
     },
     {
-      "description": "Flux Group",
-      "groupName": "Flux",
-      "matchPackagePatterns": ["fluxcd"],
-      "matchDatasources": ["docker", "github-tags"],
-      "versioning": "semver",
+      "description": "CoreDNS Group",
+      "groupName": "CoreDNS",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/coredns/"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
-      },
-      "separateMinorPatch": true
+      }
     },
     {
-      "description": "Immich Group",
-      "groupName": "Immich",
-      "matchPackagePatterns": ["immich"],
+      "description": "External Secrets Operator Group",
+      "groupName": "External Secrets Operator",
       "matchDatasources": ["docker"],
+      "matchPackageNames": ["/external-secrets/"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
-      },
-      "separateMinorPatch": true
+      }
+    },
+    {
+      "description": "Flux Operator Group",
+      "groupName": "Flux Operator",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/flux-operator/", "/flux-instance/"],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      }
+    },
+    {
+      "description": "Intel Device Plugins Group",
+      "groupName": "Intel-Device-Plugins",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": [
+        "/intel-device-plugins-operator/",
+        "/intel-device-plugins-gpu/"
+      ],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      }
     },
     {
       "description": "Rook-Ceph Group",
@@ -76,22 +112,22 @@
     {
       "description": "Tdarr Group",
       "groupName": "Tdarr",
-      "matchPackagePatterns": ["tdarr","tdarr_node"],
+      "matchPackagePatterns": ["tdarr", "tdarr_node"],
       "matchDatasources": ["docker"],
       "group": { "commitMessageTopic": "{{{groupName}}} group" },
       "separateMinorPatch": true
     },
     {
-      "description": "Thanos Group",
-      "groupName": "Thanos",
-      "matchPackagePatterns": ["thanos"],
-      "matchDatasources": ["docker", "github-releases", "helm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "group": { "commitMessageTopic": "{{{groupName}}} group" },
-      "separateMinorPatch": false
+      "description": "Spegel Group",
+      "groupName": "Spegel",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/spegel/"],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      }
     },
     {
-      "description": "Vinkuja images",
+      "description": "Vinkuja Group",
       "groupName": "Vikunja",
       "matchPackagePatterns": ["vikunja"],
       "matchDatasources": ["docker"],