diff --git a/.github/renovate.json b/.github/renovate.json
index 83d13088..489e04f9 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -7,5 +7,19 @@
   ],
   "nix": {
     "enabled": true
-  }
+  },
+  "packageRules": [
+    {
+      "description": "Bump manually in lock-step with flake.nix's protoc.",
+      "matchManagers": ["maven"],
+      "matchPackageNames": ["com.google.protobuf:*"],
+      "enabled": false
+    },
+    {
+      "description": "Stay on Kotlin 2.0.x to keep the consumer floor low.",
+      "matchManagers": ["maven"],
+      "matchPackageNames": ["org.jetbrains.kotlin:*"],
+      "allowedVersions": "<2.1.0"
+    }
+  ]
 }