diff --git a/default.json b/default.json
index b7bea768..1cd8615d 100644
--- a/default.json
+++ b/default.json
@@ -5,6 +5,7 @@
   ],
   "timezone": "Europe/Zurich",
   "branchPrefix": "renovate-",
+  "osvVulnerabilityAlerts": true,
   "hostRules": [
     {
       "matchHost": "registry.npmjs.org",
@@ -87,6 +88,24 @@
       "schedule": ["after 2pm on Monday"],
       "minimumReleaseAge": "14 days"
     },
+    {
+      "description": "Renovate cannot enforce a minimum release age on these update types, because they carry no usable release timestamp. Leaving them subject to `minimumReleaseAge` makes the branch-level `renovate/stability-days` check go permanently yellow, which silently blocks automerge forever. Mirrors the carve-outs in Renovate's own `security:minimumReleaseAge*` presets.",
+      "matchUpdateTypes": [
+        "pin",
+        "pinDigest",
+        "bump",
+        "lockfileUpdate",
+        "lockFileMaintenance",
+        "rollback",
+        "replacement"
+      ],
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "Digest updates do have a release timestamp at lookup time, but the branch stage does not always carry it forward (renovatebot/renovate#45236), which strands the stability check in a permanently pending state. Accept a timestamp when one is available instead of requiring it.",
+      "matchUpdateTypes": ["digest"],
+      "minimumReleaseAgeBehaviour": "timestamp-optional"
+    },
     {
       "matchDatasources": ["orb"],
       "matchUpdateTypes": ["patch", "minor"],