diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ecbc5ab9..2cf0eff3 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -63,10 +63,11 @@
     {
       "groupName": "frozen",
       "matchPackageNames": [
-        "winsafe",
-        "System.CommandLine",
-        "Microsoft.Extensions.Logging.Abstractions",
-        "@vercel/webpack-asset-relocator-loader"
+        "winsafe",                                    // newer versions causes runtime errors in release builds
+        "System.CommandLine",                         // too many breaking changes too frequently
+        "Microsoft.Extensions.Logging.Abstractions",  // we have multiple versions of this
+        "@vercel/webpack-asset-relocator-loader",     // an update was incompatible with electron
+        "xunit.runner.visualstudio"                   // 20-12-2024: broke tests (something about sn signing maybe?)
       ],
       "dependencyDashboardApproval": true
     },
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cd67c8bc..e74ced9e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,6 +9,7 @@ on:
 
 permissions:
   id-token: write
+  actions: write
   contents: read
 
 env: