diff --git a/renovate.json b/renovate.json
index 8b028d074..3cd919a2b 100644
--- a/renovate.json
+++ b/renovate.json
@@ -68,10 +68,12 @@
       "enabled": false
     },
     {
-      "description": "Ignore gh-aw dependency updates in workflow files; upgrade agentic workflows with gh aw upgrade instead",
-      "matchFileNames": [".github/workflows/**"],
-      "matchPackageNames": ["/gh-aw/"],
-      "enabled": false
+      "description": "Group gh-aw compiler and setup action updates; recompile workflow locks before merging",
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["github/gh-aw", "github/gh-aw-actions"],
+      "groupName": "gh-aw",
+      "groupSlug": "gh-aw",
+      "automerge": false
     },
     {
       "description": "Skip TypeScript 7.0 series",