diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml
index b5a5d17..6e90d97 100644
--- a/.github/workflows/on-pr.yaml
+++ b/.github/workflows/on-pr.yaml
@@ -10,7 +10,8 @@ on:
       - reopened
       - synchronize
     paths:
-      - '.github/workflows/on-pr.yaml'
+      - 'renovate.json'
+      - '.github/workflows/**'
       - '.gitops/**'
       - 'apis/**'
       - 'examples/**'
diff --git a/renovate.json b/renovate.json
index fef50b6..58675e2 100644
--- a/renovate.json
+++ b/renovate.json
@@ -11,6 +11,21 @@
     ]
   },
   "packageRules": [
+    {
+      "description": "Automerge minor and patch updates after all checks pass",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "automerge": true
+    },
+    {
+      "description": "Require manual review for major updates",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false
+    },
     {
       "description": "Disable automatic updates for all hops-ops Docker images",
       "matchDatasources": [
@@ -22,7 +37,7 @@
       ]
     },
     {
-      "description": "Group all AWS provider packages together for batched updates",
+      "description": "Group AWS provider-family packages",
       "matchPackageNames": [
         "/provider-family-aws/",
         "/provider-aws-.*/"
@@ -41,7 +56,7 @@
       "semanticCommitScope": "deps"
     },
     {
-      "description": "Use fix(deps): commit prefix for other Crossplane packages from Docker registries",
+      "description": "Use feat(deps): commit prefix for other Crossplane packages from Docker registries",
       "matchManagers": [
         "custom.regex"
       ],
@@ -56,30 +71,65 @@
     {
       "customType": "regex",
       "description": "hops-ops Crossplane configurations (tracked via GitHub Releases)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*ghcr\\.io/hops-ops/(?<depName>.*?)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "github-releases",
-      "packageNameTemplate": "hops-ops/{{depName}}"
+      "versioningTemplate": "npm",
+      "packageNameTemplate": "hops-ops/{{depName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
     },
     {
       "customType": "regex",
-      "description": "Crossplane packages from other registries (tracked via Docker tags)",
+      "description": "Crossplane packages from xpkg registries (tracked via Docker tags)",
+      "matchStringsStrategy": "recursive",
       "managerFilePatterns": [
         "apis/**/configuration.yaml",
         "upbound.yaml"
       ],
       "matchStrings": [
-        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')>=(?<currentValue>.*?)(\"|')\\s*"
+        "\\s*(configuration|function|package|provider):\\s*(?<registryUrl>xpkg\\.[^/]+)\\/(?<orgName>[^/]+)\\/(?<repoName>[^/\\s]+)\\s*version:\\s*(\"|')\\^v?[0-9]+(\"|')\\s*",
+        "(?<currentValue>\\^v?[0-9]+)"
       ],
       "datasourceTemplate": "docker",
+      "versioningTemplate": "npm",
       "registryUrlTemplate": "https://{{registryUrl}}",
       "depNameTemplate": "{{orgName}}/{{repoName}}",
-      "packageNameTemplate": "{{orgName}}/{{repoName}}"
+      "packageNameTemplate": "{{orgName}}/{{repoName}}",
+      "autoReplaceStringTemplate": "^v{{{newMajor}}}"
+    },
+    {
+      "customType": "regex",
+      "description": "Annotated runtime dependencies in schemas, templates, examples, and tests",
+      "managerFilePatterns": [
+        "apis/**/*.yaml",
+        "examples/**/*.yaml",
+        "functions/**/*.yaml.gotmpl",
+        "tests/**/*.k"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s+|:=\\s*|[\"']?(?:version|chartVersion|tag|default)[\"']?\\s*(?:[=:]\\s*|\\s+))[\"']?(?<currentValue>v?[0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?(?:default\\s*:\\s*|[\"']?image[\"']?\\s*[=:]\\s*)[\"']?[A-Za-z0-9._/-]+:(?<currentValue>v?[A-Za-z0-9][^\\s\"'}]*)",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: registryUrl=(?<registryUrl>\\S+))?\\s+[^\\n]*?package\\s*=\\s*\"xpkg\\.[^/]+/[^\"]+:(?<currentValue>[^\"]+)\""
+      ]
     }
-  ]
+  ],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/__fixtures__/**",
+    "**/fixtures/**"
+  ],
+  "automergeType": "pr",
+  "platformAutomerge": false,
+  "ignoreTests": false
 }
diff --git a/upbound.yaml b/upbound.yaml
index bd06b56..19b2d86 100644
--- a/upbound.yaml
+++ b/upbound.yaml
@@ -7,11 +7,11 @@ spec:
   - apiVersion: pkg.crossplane.io/v1
     kind: Provider
     package: xpkg.crossplane.io/crossplane-contrib/provider-aws-ec2
-    version: ">=v2"
+    version: "^v2"
   - apiVersion: pkg.crossplane.io/v1
     kind: Function
     package: xpkg.crossplane.io/crossplane-contrib/function-auto-ready
-    version: '>=v0.6.2'
+    version: '^v0'
   description: |
     Network creates AWS VPCs with subnets, routing, NAT gateways, and optional
     enterprise features. Supports IPv4, IPv6, and dual-stack configurations.