diff --git a/renovate.json5 b/renovate.json5
index 49f8600..9c0dfde 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -3,5 +3,20 @@
 
   "extends": [
     "github>LLK/scratch-renovate-config"
-  ]
+  ],
+
+  "vulnerabilityAlerts": {
+    "packageRules": [
+      {
+        "matchCurrentVersion": "!/^0/",
+        "matchUpdateTypes": [
+          "minor",
+          "patch",
+          "lockFileMaintenance"
+        ],
+        "automerge": true,
+        "rebaseWhen": "behind-base-branch"
+      }
+    ]
+  }
 }