diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 0c2b94a0d8..80aead349e 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,7 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base"
+    "config:base",
+    "docker:pinDigests",
+    "helpers:pinGitHubActionDigests"
   ],
   "ignorePaths": ["instrumentation/**"],
   // needed in order to get patch-only updates in package rules below