diff --git a/pyproject.toml b/pyproject.toml
index 93c307a..5c8310f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -116,6 +116,16 @@ python-version = "3.10"
 [tool.ty.src]
 include = ["src", "tests", "scripts", "docs", "website"]
 
+[tool.uv]
+# Minimal defense against supply-chain attacks.
+exclude-newer = "24 hours"
+
+[tool.uv.exclude-newer-package]
+# Allow internal Apify packages to install immediately.
+apify-client = false
+apify_fingerprint_datapoints = false
+crawlee = false
+
 # Run tasks with: uv run poe <task>
 [tool.poe.tasks]
 clean = "rm -rf .coverage .pytest_cache .ruff_cache .ty_cache build dist htmlcov"
diff --git a/renovate.json b/renovate.json
index 4673049..ace49fb 100644
--- a/renovate.json
+++ b/renovate.json
@@ -8,7 +8,8 @@
     "lockFileMaintenance": {
         "enabled": true,
         "automerge": true,
-        "automergeType": "branch"
+        "automergeType": "pr",
+        "schedule": ["* 0-5 * * 1"]
     },
     "packageRules": [
         {
@@ -19,7 +20,17 @@
             "groupSlug": "dev-dependencies",
             "automerge": true,
             "automergeType": "branch"
+        },
+        {
+            "matchPackageNames": ["@apify/*", "@crawlee/*", "apify", "apify-client", "apify-shared", "apify-fingerprint-datapoints", "crawlee", "got-scraping"],
+            "minimumReleaseAge": "0 days"
+        },
+        {
+            "matchUpdateTypes": ["lockFileMaintenance"],
+            "minimumReleaseAgeBehaviour": "timestamp-optional"
         }
     ],
-    "schedule": ["before 7am every weekday"]
+    "minimumReleaseAge": "1 day",
+    "internalChecksFilter": "strict",
+    "schedule": ["* 0-5 * * 2-5"]
 }