diff --git a/.renovate/base.json5 b/.renovate/base.json5
index 51761d6..06c59ba 100644
--- a/.renovate/base.json5
+++ b/.renovate/base.json5
@@ -2,11 +2,10 @@
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: [
     "config:best-practices",
+    "helpers:pinGitHubActionDigestsToSemver",
   ],
   dependencyDashboardTitle: "Renovate Dashboard 🤖",
   suppressNotifications: ["prEditedNotification", "prIgnoreNotification"],
-  pinDigests: true,
-  rangeStrategy: "pin",
   labels: ["dependencies"],
   osvVulnerabilityAlerts: true,
   timezone: 'Europe/Amsterdam',
diff --git a/config-sync/files/renovate.json5 b/config-sync/files/renovate.json5
index 3359a7b..6645d7d 100644
--- a/config-sync/files/renovate.json5
+++ b/config-sync/files/renovate.json5
@@ -2,7 +2,7 @@
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: [
     "config:recommended",
-    "helpers:pinGitHubActionDigests",
+    "helpers:pinGitHubActionDigestsToSemver",
     ":dependencyDashboard",
     ":semanticCommits",
     "github>DevSecNinja/.github//.renovate/autoMerge.json5",
diff --git a/docs/architecture.md b/docs/architecture.md
index 08d50c3..854c64d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -490,7 +490,7 @@ Repositories import the shared fragments in their `renovate.json5`:
 {
   extends: [
     "config:recommended",
-    "helpers:pinGitHubActionDigests",
+    "helpers:pinGitHubActionDigestsToSemver",
     ":dependencyDashboard",
     ":semanticCommits",
     "github>DevSecNinja/.github//.renovate/autoMerge.json5",