diff --git a/.github/renovate.jsonc b/.github/renovate.jsonc
index ba3ded5..0d1d55f 100644
--- a/.github/renovate.jsonc
+++ b/.github/renovate.jsonc
@@ -1,10 +1,10 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "description": "Dashboard-gated dependency updates for GSwitch. Routine updates wait until a release is three days old; security fixes do not.",
+  "description": "Dependency update proposals for GSwitch. Routine updates wait until a release is three days old, and major updates and lock file maintenance also wait for dashboard approval; security fixes do neither.",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "enabledManagers": ["npm", "cargo", "github-actions"],
   "dependencyDashboard": true,
-  "dependencyDashboardApproval": true,
+  "dependencyDashboardApproval": false,
   "dependencyDashboardAutoclose": false,
   "dependencyDashboardLabels": ["dependencies"],
   "automerge": false,
@@ -17,7 +17,8 @@
   "minimumReleaseAge": "3 days",
   "internalChecksFilter": "strict",
   "lockFileMaintenance": {
-    "enabled": true
+    "enabled": true,
+    "dependencyDashboardApproval": true
   },
   "vulnerabilityAlerts": {
     "enabled": true,
@@ -31,9 +32,10 @@
   },
   "packageRules": [
     {
-      "description": "Keep major updates isolated for compatibility review.",
+      "description": "Keep major updates isolated and behind dashboard approval for compatibility review.",
       "matchUpdateTypes": ["major"],
-      "groupName": null
+      "groupName": null,
+      "dependencyDashboardApproval": true
     },
     {
       "description": "Update compatible Tauri Rust and JavaScript packages together.",
diff --git a/docs/testing.md b/docs/testing.md
index ea0e996..0ec245a 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -122,12 +122,13 @@ Rust and Node versions are owned by `rust-toolchain.toml` and `.node-version`;
 pnpm is owned by `package.json`'s `packageManager`.
 
 Renovate's [Dependency Dashboard](https://github.com/ginbing/GSwitch/issues/110)
-is the intake queue for routine npm, Cargo, and GitHub Actions updates. A
-routine update creates a branch only after dashboard approval and once the
-release is at least three days old; recreating one by hand follows the same
-age rule. Renovate opens security remediation PRs immediately, without
-automerge; GitHub Dependabot Alerts remain a signal but Dependabot Security
-Updates PRs are disabled.
+lists routine npm, Cargo, and GitHub Actions updates. Minor and patch updates
+open a pull request once the release is at least three days old, at most two
+at a time. Major updates and lock file maintenance also wait for dashboard
+approval. Recreating an update by hand follows the same age rule. Renovate
+opens security remediation PRs immediately, without automerge; GitHub
+Dependabot Alerts remain a signal but Dependabot Security Updates PRs are
+disabled.
 
 A Renovate pull request is a proposal, not a merge candidate. Merging it
 directly records the bot as a commit author and lists it as a contributor.