diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 27c17456..722aa9db 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,8 @@ updates:
   schedule:
     interval: "daily"
   open-pull-requests-limit: 1000
+- package-ecosystem: "gradle"
+  open-pull-requests-limit: 0 # Disable Gradle updates, Renovate will do it
+  directory: "/"
+  schedule:
+    interval: "daily"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a4ed804b..e37d9068 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@v4
       with:
         submodules: recursive
         lfs: true
diff --git a/.github/workflows/codeowners-validator.yml b/.github/workflows/codeowners-validator.yml
index 6e6ec45e..5f598f01 100644
--- a/.github/workflows/codeowners-validator.yml
+++ b/.github/workflows/codeowners-validator.yml
@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@v4
       with:
         fetch-depth: 1
 
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 92b9c2b3..63ac24bf 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -13,11 +13,16 @@ defaults:
 
 jobs:
   codespell:
+    if: ${{
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+      || (github.event_name == 'push' && !startsWith(github.event.head_commit.message, '[push-back]'))
+      || github.event_name != 'push'
+      }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      uses: actions/checkout@v4
       with:
         submodules: recursive
         fetch-depth: 0
diff --git a/.mergify/config.yml b/.mergify/config.yml
index 60fbdd19..e5ec2f2f 100644
--- a/.mergify/config.yml
+++ b/.mergify/config.yml
@@ -8,6 +8,7 @@ pull_request_rules:
 - name: Auto merge approved
   conditions:
   - '#approved-reviews-by>=1'
+  - -files~=^(\.github/)?renovate\.json5?$
   - -conflict
   - -closed
   - -merged
@@ -28,6 +29,7 @@ pull_request_rules:
   - '#approved-reviews-by=0'
   - author~=^(dependabot(-preview)?|renovate)\[bot\]$
   - label!=sync-with-template
+  - -files~=^(\.github/)?renovate\.json5?$
   - 'check-neutral!=renovate/stability-days'
   - 'check-pending!=renovate/stability-days'
   - 'check-failure!=renovate/stability-days'