diff --git a/admin-system/renovate.yaml b/admin-system/renovate.yaml
index b75ae4d..a040af3 100644
--- a/admin-system/renovate.yaml
+++ b/admin-system/renovate.yaml
@@ -52,7 +52,7 @@ data:
       },
       "customManagers": [
         {
-          "description": "termix uses a release-X.Y.Z prefixed tag. extractVersion + loose doesn't work because Renovate validates the raw currentValue BEFORE applying extractVersion. Using regex versioning (which parses the prefixed value directly) sidesteps the pre-check. Datasource redirected to GitHub Releases at Termix-SSH/Termix so the 3-day stability gate has real timestamps to work with.",
+          "description": "termix: docker image tag is `release-X.Y.Z` but the upstream GitHub release tag_name is `release-X.Y.Z-tag` (different from the release name). regex versioning parses currentValue (no -tag); extractVersion strips the -tag suffix from candidate tag_names so they normalize to the same shape Renovate writes back to the manifest.",
           "customType": "regex",
           "managerFilePatterns": ["/termix-system/.+\\.ya?ml$/"],
           "matchStrings": [
@@ -60,7 +60,8 @@ data:
           ],
           "datasourceTemplate": "github-releases",
           "packageNameTemplate": "Termix-SSH/Termix",
-          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+          "extractVersionTemplate": "^(?<version>release-\\d+\\.\\d+\\.\\d+)"
         }
       ],
       "packageRules": [