diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index a89ec40..27963b7 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6.7.0
         with:
           enable-cache: true
       - run: uv run ./bin/lint
diff --git a/.python-version b/.python-version
index 64af02e..976544c 100644
--- a/.python-version
+++ b/.python-version
@@ -1 +1 @@
-3.13.6
+3.13.7
diff --git a/renovate.json b/renovate.json
index 5c9e820..e75e658 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "customManagers:githubActionsVersions",
+    "helpers:pinGitHubActionDigests"
   ],
   "configMigration": true,
   "packageRules": [
@@ -10,6 +12,33 @@
       "matchDepNames": [
         "ruff"
       ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
+      "automerge": true
+    },
+
+    {
+      "groupName": "Linter dependencies",
+      "description": "Group linter updates",
+      "matchFileNames": [
+        ".pre-commit-config.yaml"
+      ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
+      "automerge": true
+    },
+    {
+      "groupName": "GitHub Actions dependencies",
+      "description": "Group GitHub Actions updates",
+      "matchFileNames": [
+        ".github/**/*.yaml",
+        ".github/**/*.yml"
+      ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
       "automerge": true
     }
   ],