diff --git a/renovate.json b/renovate.json
index 3d0310e..5891ccc 100644
--- a/renovate.json
+++ b/renovate.json
@@ -20,10 +20,30 @@
   "platformAutomerge": false,
   "minimumReleaseAge": "7 days",
   "stabilityDays": 7,
+  "allowedPostUpgradeCommands": [
+    "pnpm install"
+  ],
   "lockFileMaintenance": {
     "enabled": true
   },
   "packageRules": [
+    {
+      "description": "Default: run pnpm install after any npm-managed upgrade",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchPackageFiles": [
+        "package.json"
+      ],
+      "postUpgradeTasks": {
+        "commands": [
+          "pnpm install"
+        ],
+        "fileFilters": [
+          "pnpm-lock.yaml"
+        ]
+      }
+    },
     {
       "description": "Group GitHub actions together",
       "matchManagers": [
@@ -37,9 +57,6 @@
     },
     {
       "description": "Group all npm devDependencies",
-      "matchManagers": [
-        "npm"
-      ],
       "matchDepTypes": [
         "devDependencies"
       ],
@@ -111,10 +128,14 @@
       ]
     },
     {
-      "description": "Group package manager updates (pnpm)",
+      "description": "Group Docker base image updates",
       "matchManagers": [
-        "npm"
+        "dockerfile"
       ],
+      "groupName": "docker base images"
+    },
+    {
+      "description": "Group package manager updates (pnpm)",
       "matchDepTypes": [
         "packageManager"
       ],