diff --git a/.github/renovate.jsonc b/.github/renovate.jsonc
index 107054d..ba3ded5 100644
--- a/.github/renovate.jsonc
+++ b/.github/renovate.jsonc
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "description": "Dashboard-gated dependency updates for GSwitch.",
+  "description": "Dashboard-gated dependency updates for GSwitch. Routine updates wait until a release is three days old; security fixes do not.",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "enabledManagers": ["npm", "cargo", "github-actions"],
   "dependencyDashboard": true,
@@ -14,6 +14,8 @@
   "separateMajorMinor": true,
   "separateMultipleMajor": true,
   "labels": ["dependencies"],
+  "minimumReleaseAge": "3 days",
+  "internalChecksFilter": "strict",
   "lockFileMaintenance": {
     "enabled": true
   },
@@ -28,12 +30,6 @@
     "platformAutomerge": false
   },
   "packageRules": [
-    {
-      "description": "Let npm packages age out of the unpublish window before normal updates.",
-      "matchDatasources": ["npm"],
-      "minimumReleaseAge": "3 days",
-      "internalChecksFilter": "strict"
-    },
     {
       "description": "Keep major updates isolated for compatibility review.",
       "matchUpdateTypes": ["major"],
diff --git a/docs/testing.md b/docs/testing.md
index 982d4de..ea0e996 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -123,9 +123,11 @@ pnpm is owned by `package.json`'s `packageManager`.
 
 Renovate's [Dependency Dashboard](https://github.com/ginbing/GSwitch/issues/110)
 is the intake queue for routine npm, Cargo, and GitHub Actions updates. A
-routine update creates a branch only after dashboard approval. Renovate opens
-security remediation PRs immediately, without automerge; GitHub Dependabot
-Alerts remain a signal but Dependabot Security Updates PRs are disabled.
+routine update creates a branch only after dashboard approval and once the
+release is at least three days old; recreating one by hand follows the same
+age rule. Renovate opens security remediation PRs immediately, without
+automerge; GitHub Dependabot Alerts remain a signal but Dependabot Security
+Updates PRs are disabled.
 
 A Renovate pull request is a proposal, not a merge candidate. Merging it
 directly records the bot as a commit author and lists it as a contributor.