diff --git a/renovate.json b/renovate.json
index 920dec5..eece165 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,7 +5,6 @@
     ":semanticCommits",
     ":semanticCommitTypeAll(deps)",
     ":dependencyDashboard",
-    ":automergeMinor",
     "schedule:weekly",
     "group:allNonMajor"
   ],
@@ -21,10 +20,10 @@
   },
   "packageRules": [
     {
-      "description": "Auto-merge patch + minor when CI passes. The vulnerability-alert override at the end of this array re-disables automerge for CVE-triggered PRs (Renovate evaluates packageRules in order; later rules win).",
+      "description": "Patch + minor open a PR and wait for a human. Renovate has never executed in this org, so nothing here has been observed doing what it claims; automerge stays off until a few cycles of real PRs have been reviewed. automergeType is 'pr' rather than 'branch' for when it is re-enabled: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.",
       "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true,
-      "automergeType": "branch"
+      "automerge": false,
+      "automergeType": "pr"
     },
     {
       "description": "Major upgrades always need review",
@@ -35,14 +34,14 @@
     {
       "description": "Group @aws-sdk/* (npm) — they release together",
       "matchManagers": ["npm"],
-      "matchPackagePatterns": ["^@aws-sdk/", "^@smithy/"],
-      "groupName": "aws-sdk-js"
+      "groupName": "aws-sdk-js",
+      "matchPackageNames": ["/^@aws-sdk//", "/^@smithy//"]
     },
     {
       "description": "Group @opentelemetry/* — the SDK + exporters + instrumentations move together",
       "matchManagers": ["npm"],
-      "matchPackagePatterns": ["^@opentelemetry/"],
-      "groupName": "opentelemetry"
+      "groupName": "opentelemetry",
+      "matchPackageNames": ["/^@opentelemetry//"]
     },
     {
       "description": "Group the Postgres client + its types",
@@ -53,19 +52,19 @@
     {
       "description": "Group typescript-eslint plugins",
       "matchManagers": ["npm"],
-      "matchPackagePatterns": [
-        "^@typescript-eslint/",
-        "^typescript-eslint$",
-        "^@eslint/",
-        "^eslint-plugin-"
-      ],
-      "groupName": "eslint-stack"
+      "groupName": "eslint-stack",
+      "matchPackageNames": [
+        "/^@typescript-eslint//",
+        "/^typescript-eslint$/",
+        "/^@eslint//",
+        "/^eslint-plugin-/"
+      ]
     },
     {
       "description": "Group vitest core + coverage",
       "matchManagers": ["npm"],
-      "matchPackagePatterns": ["^vitest$", "^@vitest/"],
-      "groupName": "vitest"
+      "groupName": "vitest",
+      "matchPackageNames": ["/^vitest$/", "/^@vitest//"]
     },
     {
       "description": "GitHub Actions — group minor + patch into one PR",