diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 612ea6196d..35fe64baf3 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -5,6 +5,7 @@
     ":automergeStableNonMajor",
     ":automergeTypes",
     ":maintainLockFilesWeekly",
+    "helpers:pinGitHubActionDigests",
   ],
 
   "enabledManagers": [
@@ -105,6 +106,11 @@
       ],
       "rangeStrategy": "widen",
     },
+    {
+      "groupName": "github-actions",
+      "groupSlug": "github-actions",
+      "matchManagers": ["github-actions"],
+    },
   ],
   "postUpdateOptions": [
     "pnpmDedupe",