diff --git a/renovate.json b/renovate.json
index 2992cadb8..e54c198a3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,14 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "github>conforma/.github//config/renovate/renovate.json"
-  ]
+  ],
+  // Vulnerability/security fixes are already kept as standalone PRs and created
+  // immediately: Renovate internally forces `groupName: null` and ignores the
+  // daily `schedule` for vulnerability alerts via its built-in `force` block,
+  // which outranks user config — so an explicit ungrouping rule or a `schedule`
+  // override would be a no-op and is intentionally omitted.
+  // Here we only add labels so CVE-fix PRs are easy to spot and route.
+  "vulnerabilityAlerts": {
+    "labels": ["security", "renovate"]
+  }
 }