diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 38d29404e..6fe8f59c9 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -42,6 +42,13 @@
       matchStrings: ['cdn\\.jsdelivr\\.net/npm/(?<depName>[^@]+)@(?<currentValue>[^/]+)'],
       datasourceTemplate: 'npm',
     },
+    /** Python version in actions/setup-python action */
+    {
+      fileMatch: ['^\\.github/workflows/.*\\.yaml$'],
+      matchStrings: [' python-version: [\'"](?<currentValue>[0-9\\.]+)[\'"]'],
+      datasourceTemplate: 'python-version',
+      depNameTemplate: 'python',
+    },
   ],
   packageRules: [
     /** Docker images versioning */
@@ -129,5 +136,15 @@
       matchPackageNames: ['shellcheck-py/shellcheck-py'],
       versioning: 'regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$',
     },
+    /** Packages published very recently are not pushed to stabilization branches for security reasons */
+    {
+      matchBaseBranches: ['/^prod-[0-9]+-[0-9]+(-advance)?$/'],
+      minimumReleaseAge: '7 days',
+    },
+    /** Ungroup Python dependencies */
+    {
+      matchDepNames: ['python'],
+      groupName: 'Python',
+    },
   ],
 }
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index da0422a93..e839b9ee8 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -13,8 +13,8 @@ env:
 
 jobs:
   main:
-    runs-on: ubuntu-24.04
     name: Continuous integration
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
 
     steps:
diff --git a/ci/config.yaml b/ci/config.yaml
index 7c6b377c8..fac070399 100644
--- a/ci/config.yaml
+++ b/ci/config.yaml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/1.6.22/c2cciutils/schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/1.6.23/c2cciutils/schema.json
 
 version:
   branch_to_version_re: