diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 53f7a53..abdad0e 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -1,8 +1,17 @@
 name: Renovate
 
 on:
-  # Weekly sweep. Mondays 05:00 UTC — this cron owns the cadence; the repo's
-  # renovate.json5 deliberately has no internal schedule (avoids double-gating).
+  # Every merge to main. Mirror syncs from Codeberg fire push events here (the
+  # same trigger release.yaml relies on), so a merged Renovate PR is followed
+  # within minutes by a run that rebases the sibling PRs it just conflicted —
+  # most bumps touch gradle/libs.versions.toml. Outside renovate.json5's
+  # `schedule` window such a run only maintains existing branches
+  # (updateNotScheduled), it never opens new PRs. Renovate's own rebases push
+  # to renovate/* branches, not main, so this cannot loop.
+  push:
+    branches: [main]
+  # Weekly sweep for new updates. Mondays 05:00 UTC, inside the schedule window
+  # in renovate.json5 — keep the two in step.
   schedule:
     - cron: '0 5 * * 1'
   # Manual run for an on-demand sweep from the Actions tab.
diff --git a/renovate.json5 b/renovate.json5
index 378bf07..f1fa98d 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -52,9 +52,16 @@
   prConcurrentLimit: 5,
   prHourlyLimit: 0,
 
-  // Cadence is owned by the Gitea Actions cron (.gitea/workflows/renovate.yml,
-  // Mondays) — no internal `schedule` here, so the two don't double-gate and
-  // silently skip a run.
+  // New branches/PRs only in the Monday window (UTC), which brackets the weekly
+  // cron in .gitea/workflows/renovate.yml with slack for a late start — keep
+  // the two in step, or the sweep lands outside the window and finds nothing.
+  // The same workflow also runs on every push to main; those runs fall outside
+  // the window and, via the default updateNotScheduled: true, only maintain
+  // existing branches — chiefly rebasing PRs a merge just conflicted.
+  schedule: ["* 4-6 * * 1"],
+  // Rebase only on conflict, not every time main moves (automerge is off, so
+  // this matches "auto"; spelled out because the on-merge trigger relies on it).
+  rebaseWhen: "conflicted",
 
   // Gitea Actions workflows live under .gitea/workflows, not .github — extend
   // the github-actions manager (same syntax) to watch them too.