diff --git a/admin-system/renovate.yaml b/admin-system/renovate.yaml
index ce39ffc..3934443 100644
--- a/admin-system/renovate.yaml
+++ b/admin-system/renovate.yaml
@@ -52,36 +52,80 @@ data:
       },
       "packageRules": [
         {
+          "description": "Default-deny everything",
           "matchPackageNames": ["*"],
           "enabled": false
         },
         {
+          "description": "Tier 1: enable updates for low-risk leaf apps",
           "matchPackageNames": [
             "ghcr.io/thomiceli/opengist",
             "louislam/uptime-kuma",
             "f0rc3/gokapi",
-            "docker.io/calcom/cal.com"
+            "docker.io/calcom/cal.com",
+            "advplyr/audiobookshelf",
+            "arcadiatechnology/crafty-4",
+            "codercom/code-server",
+            "ghcr.io/gethomepage/homepage",
+            "ghcr.io/headlamp-k8s/headlamp",
+            "prom/node-exporter",
+            "rommapp/romm",
+            "ghcr.io/stakater/reloader",
+            "privatebin/nginx-fpm-alpine",
+            "flomp/wanderer-db",
+            "flomp/wanderer-web",
+            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
+            "ghcr.io/lukegus/termix"
           ],
           "enabled": true
         },
         {
+          "description": "Tier 1: automerge minor/patch after 3-day stability window",
           "matchPackageNames": [
             "ghcr.io/thomiceli/opengist",
             "louislam/uptime-kuma",
             "f0rc3/gokapi",
-            "docker.io/calcom/cal.com"
+            "docker.io/calcom/cal.com",
+            "advplyr/audiobookshelf",
+            "arcadiatechnology/crafty-4",
+            "codercom/code-server",
+            "ghcr.io/gethomepage/homepage",
+            "ghcr.io/headlamp-k8s/headlamp",
+            "prom/node-exporter",
+            "rommapp/romm",
+            "ghcr.io/stakater/reloader",
+            "privatebin/nginx-fpm-alpine",
+            "flomp/wanderer-db",
+            "flomp/wanderer-web",
+            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
+            "ghcr.io/lukegus/termix"
           ],
           "matchUpdateTypes": ["minor", "patch"],
           "automerge": true,
+          "automergeType": "pr",
           "platformAutomerge": true,
-          "automergeType": "pr"
+          "minimumReleaseAge": "3 days"
         },
         {
+          "description": "Tier 1: major bumps require dashboard approval (no automerge)",
           "matchPackageNames": [
             "ghcr.io/thomiceli/opengist",
             "louislam/uptime-kuma",
             "f0rc3/gokapi",
-            "docker.io/calcom/cal.com"
+            "docker.io/calcom/cal.com",
+            "advplyr/audiobookshelf",
+            "arcadiatechnology/crafty-4",
+            "codercom/code-server",
+            "ghcr.io/gethomepage/homepage",
+            "ghcr.io/headlamp-k8s/headlamp",
+            "prom/node-exporter",
+            "rommapp/romm",
+            "ghcr.io/stakater/reloader",
+            "privatebin/nginx-fpm-alpine",
+            "flomp/wanderer-db",
+            "flomp/wanderer-web",
+            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
+            "ghcr.io/lukegus/termix"
           ],
           "matchUpdateTypes": ["major"],
           "automerge": false,