diff --git a/renovate.json b/renovate.json
index de9a5ca..11f2d38 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,19 +3,32 @@
   "extends": [
     "config:recommended",
     "helpers:pinGitHubActionDigests",
-    ":rebaseStalePrs",
-    "group:all"
+    ":rebaseStalePrs"
+  ],
+  "reviewers": [
+    "martinfrancois"
+  ],
+  "labels": [
+    "dependencies"
   ],
-  "reviewers": ["martinfrancois"],
-  "labels": ["dependencies"],
   "rangeStrategy": "replace",
+  "pinDigests": true,
+  "prConcurrentLimit": 0,
+  "branchConcurrentLimit": 0,
   "minimumReleaseAge": "7 days",
   "minimumReleaseAgeBehaviour": "timestamp-required",
   "internalChecksFilter": "strict",
-  "automerge": false,
+  "statusCheckWhen": {
+    "minimumReleaseAge": "never"
+  },
+  "dependencyDashboardApproval": false,
+  "separateMajorMinor": true,
+  "separateMultipleMajor": true,
   "vulnerabilityAlerts": {
     "enabled": true,
-    "labels": ["security"]
+    "labels": [
+      "security"
+    ]
   },
   "customManagers": [
     {
@@ -46,20 +59,27 @@
   ],
   "packageRules": [
     {
-      "description": "Require review for GitHub Actions and pinned action digest updates",
-      "matchManagers": ["github-actions"],
-      "automerge": false
-    },
-    {
-      "description": "Require review for workflow-managed tooling such as Tessl CLI and commitlint",
-      "matchManagers": ["custom.regex"],
-      "automerge": false
+      "description": "Bundle every non-major update into one automergeable pull request. Major updates are deliberately excluded so that a pending major never holds back the bundle.",
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "pin",
+        "pinDigest",
+        "digest"
+      ],
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-non-major",
+      "automerge": true
     },
     {
-      "matchUpdateTypes": ["major"],
+      "description": "Major updates land one at a time and require a human merge after review of the migration notes. No groupName is set: majors are already ungrouped because the bundle rule matches non-major types only, and forcing one would split lockstep groups.",
+      "matchUpdateTypes": [
+        "major"
+      ],
       "automerge": false,
-      "dependencyDashboardApproval": true,
-      "addLabels": ["major-update"]
+      "addLabels": [
+        "major update"
+      ]
     }
   ]
 }