diff --git a/.github/renovate.json b/.github/renovate.json
index 7f6c726..68c2c16 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,8 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":semanticCommitTypeAll(chore)",
-    "helpers:pinGitHubActionDigests"
-  ]
+  "extends": ["github>BrianEstrada/.github"]
 }
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 0360505..fffc349 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -16,8 +16,9 @@ permissions:
 
 jobs:
   review:
-    # Fork PRs don't get secrets, so there's nothing to authenticate with.
-    if: ${{ !github.event.pull_request.draft && github.event.pull_request.head.repo.full_name == github.repository }}
+    # Fork PRs don't get secrets, so there's nothing to authenticate with. Renovate's PRs run updated
+    # dependencies' code, which shouldn't see the Claude secrets.
+    if: ${{ !github.event.pull_request.draft && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'renovate[bot]' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps: