diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
index 3fbb161..c313aac 100644
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -158,6 +158,11 @@ jobs:
           # asserts that every `configurationFile:` here names a file that exists.
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
+          # PINNED 2026-10-29. Unset, this action version runs Renovate `39` (action.yml
+          # `renovate-version` default at v41.0.9), i.e. 39.264.0, and renovate.json5 uses
+          # `managerFilePatterns` (>= 40.2.0): under 39.x validation fails with five errors and
+          # the run stops at CONFIG_VALIDATION. #79 validated against `latest`, not this.
+          renovate-version: 44.167.0
         env:
           # Self-hosted Gitea. `platform` + `endpoint` were the two values renovate.json's own
           # header said were "set at runtime by the operator's renovate runner" — this is that
diff --git a/decisions/2026-10-29-renovate-config-filename.md b/decisions/2026-10-29-renovate-config-filename.md
index bd30d4f..cf26844 100644
--- a/decisions/2026-10-29-renovate-config-filename.md
+++ b/decisions/2026-10-29-renovate-config-filename.md
@@ -23,6 +23,13 @@ passes and this filename is the only blocker observed.
 `.gitea/workflows/*.y*ml` must name a path that exists. This is valid YAML, so yamllint cannot see
 it, and the gate stayed green through 11 days of failures.
 
+**Second blocker, same PR:** the workflow did not pin a Renovate version, so
+`renovatebot/github-action@v41.0.9` ran its default, Renovate **39** (`action.yml`:
+`renovate-version` `default: '39'`, read at that tag). `renovate.json5` uses `managerFilePatterns`,
+which needs >= 40.2.0. Under 39.264.0 the validator rejects the config with five errors. This was
+found and reproduced by the image-pipeline worker (PR #81). #79 had validated against `latest`. Pinned
+`renovate-version: 44.167.0`, the version the config validates clean against per that worker.
+
 ## What I verified
 
 - The root cause, from the run log quoted above, and that `origin/main` has `renovate.json5` and
@@ -36,6 +43,8 @@ it, and the gate stayed green through 11 days of failures.
 
 ## What I did NOT verify
 
+- **The 39.x rejection and the 44.167.0 pass were not reproduced by me.** I confirmed only the
+  action's default (`'39'`). The validation results are the PR #81 worker's.
 - **Renovate has still never completed a run.** This removes the observed blocker. Others may
   follow it. The test is a `workflow_dispatch` with `dry_run: true` after merge, and its log is
   the first evidence that Renovate authenticates, extracts dependencies, and honours `.json5`.