diff --git a/renovate.json5 b/renovate.json5
index c6535ba..f781d95 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -9,6 +9,17 @@
   // Supply-chain cooldown: wait before proposing a bump. Doubles as protection
   // against the race where a release tag exists but its assets aren't uploaded yet.
   minimumReleaseAge: "3 days",
+  // Vulnerability-fix PRs from GitHub's Dependabot alerts (the baseline keeps
+  // the alerts on for exactly this; Dependabot's OWN update PRs are off —
+  // Renovate is the one dependency bot). Stated explicitly, not left to the
+  // preset default, because `enabled: true` here is what reaches `// indirect`
+  // Go modules: the gomod manager disables indirect deps, and the alert path
+  // re-enables a dep only when this object says enabled. Fix PRs skip the
+  // cooldown above (a known-vulnerable version is the worse risk) and take
+  // the lowest fixed version, both Renovate defaults for this object.
+  vulnerabilityAlerts: {
+    enabled: true,
+  },
   // `just do lint commits` enforces DCO on every PR range, bot commits included.
   commitBody: "Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
   // The update-aqua-checksum workflow pushes a fix-up commit onto Renovate's