diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index bf9bec59a..114eb262e 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -61,6 +61,10 @@ jobs:
           RENOVATE_REPOSITORIES: timothy/ersatztv
           RENOVATE_AUTODISCOVER: 'false'
           RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@tblindustries.be>'
+          # Let the dockerfile manager query our HTTP-only Gitea container registry for the
+          # ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry
+          # live here, NOT in renovate.json, so they stay out of the committed config.
+          RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]'
           RENOVATE_DRY_RUN: ${{ inputs.dryRun }}
           LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
         run: renovate
diff --git a/renovate.json b/renovate.json
index dd84b16f8..0ca066093 100644
--- a/renovate.json
+++ b/renovate.json
@@ -7,13 +7,29 @@
   "semanticCommits": "enabled",
   "dependencyDashboard": true,
   "labels": ["dependencies"],
-  "enabledManagers": ["nuget", "github-actions"],
+  "enabledManagers": ["nuget", "github-actions", "dockerfile"],
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "labels": ["dependencies", "security"]
   },
   "prConcurrentLimit": 5,
   "packageRules": [
+    {
+      "description": "Only manage the built amd64 docker/Dockerfile; ignore the vestigial upstream arm/ffmpeg-tests Dockerfiles (this fork ships amd64-only)",
+      "matchManagers": ["dockerfile"],
+      "matchFileNames": [
+        "docker/arm32v7/Dockerfile",
+        "docker/arm64/Dockerfile",
+        "docker/ffmpeg-tests/Dockerfile"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Group the .NET base images (mcr.microsoft.com/dotnet/*) into one PR",
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["/^mcr\\.microsoft\\.com\\/dotnet\\//"],
+      "groupName": ".NET base images"
+    },
     {
       "description": "Group the Microsoft.Extensions.* family into one PR",
       "matchPackageNames": ["/^Microsoft\\.Extensions\\./"],