diff --git a/regsync-config.yaml b/regsync-config.yaml
index a8434fc..d8fd537 100644
--- a/regsync-config.yaml
+++ b/regsync-config.yaml
@@ -190,6 +190,8 @@ sync:
     target: ${TARGET_REGISTRY}/debezium/connect
     type: repository
     tags:
+      semverRange:
+        - ">=2.5.0"
       allow:
         - '2\.([5-9]|[0-9]{2,})\.[0-9]+\.Final'
         - '[3-9]\.[0-9]+\.[0-9]+\.Final'
@@ -207,13 +209,18 @@ sync:
     target: ${TARGET_REGISTRY}/apachepinot/pinot
     type: repository
     tagSets:
-      - allow:
+      # "latest" is a sanctioned exception here: pinned alongside a specific
+      # snapshot tag needed for compatibility testing; bounded by semverRange floor below.
+      - semverRange:
+          - ">=1.5.0"
+        allow:
           - "latest"
           - "1.5.0-SNAPSHOT-43142cdc37-20251204"
       - semverRange:
           - ">=0.1.0"
         allow:
           - '[0-9]+\.[0-9]+\.[0-9]+'
+          # "latest" allowed here as a sanctioned exception to always track the newest release.
           - latest
 
   # ---------------------------------------------------------------------------
@@ -835,3 +842,4 @@ sync:
         - ">=2.23.6"
       allow:
         - '[0-9]+\.[0-9]+\.[0-9]+'
+