diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d139d181f..f6edbe5f5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -44,6 +44,8 @@ GRADLE_USER_HOME=$(mktemp -d) ./gradlew --write-verification-metadata sha256 bui
 ```
 The cold cache matters: a warm cache skips re-resolving already-cached parent POMs, so they never get recorded, and the build then fails verification only in CI (this bit us once during the migration). The run downloads everything once and takes a few minutes. Only when adding a **new** artifact that ships in the distribution does `gradle/vendored-layout.json` need a one-line placement entry, and the build fails with a message telling you so.
 
+Artifacts that are released together under one version number share a `[versions]` entry (a ref) in `gradle/libs.versions.toml`. [Renovate](https://docs.renovatebot.com/) proposes each ref's update as one PR, on a branch named after the ref, and puts a security fix for any artifact on that ref on the same branch. To keep it that way, `renovate.json` defines no groups and ignores Renovate's built-in `group:monorepos` preset, so the refs alone decide what is updated together. Don't add a `groupName` rule: a security-fix update never joins a named group, so the family would be split across two branches that edit the same line. To have several artifacts updated together, put them on one ref, which is only correct if they share a version. Artifacts on literal versions get one PR each.
+
 ### Changing build logic
 
 The build's correctness is guarded by output comparison, not by unit
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index bb6dc1f29..f8e1f014b 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -11,6 +11,7 @@
 
 [versions]
 # Shared by artifacts released together; bump the whole family at once.
+# Renovate updates each ref in one PR (see CONTRIBUTING.md).
 asm = "9.6"
 awssdk = "2.55.12"
 bouncycastle = "1.78.1"
diff --git a/renovate.json b/renovate.json
index 9b71c32a3..51ffca599 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,6 +5,9 @@
     "schedule:monthly",
     "helpers:pinGitHubActionDigests"
   ],
+  "ignorePresets": [
+    "group:monorepos"
+  ],
   "timezone": "America/New_York",
   "minimumReleaseAge": "14 days",
   "prConcurrentLimit": 10,
@@ -45,80 +48,6 @@
       "addLabels": [
         "github actions"
       ]
-    },
-    {
-      "groupName": "aws-sdk",
-      "matchPackageNames": [
-        "software.amazon.awssdk:*",
-        "software.amazon.eventstream:*"
-      ]
-    },
-    {
-      "groupName": "jetty",
-      "matchPackageNames": [
-        "org.eclipse.jetty*"
-      ]
-    },
-    {
-      "groupName": "bouncycastle",
-      "matchPackageNames": [
-        "org.bouncycastle*"
-      ]
-    },
-    {
-      "groupName": "jersey",
-      "matchPackageNames": [
-        "org.glassfish.jersey*",
-        "org.glassfish.hk2*"
-      ]
-    },
-    {
-      "groupName": "pdfbox",
-      "matchPackageNames": [
-        "*pdfbox*"
-      ]
-    },
-    {
-      "groupName": "sun-xml",
-      "matchPackageNames": [
-        "com.sun.xml*"
-      ]
-    },
-    {
-      "groupName": "jackson",
-      "matchPackageNames": [
-        "com.fasterxml.jackson*"
-      ]
-    },
-    {
-      "groupName": "netty",
-      "matchPackageNames": [
-        "io.netty*",
-        "com.typesafe.netty*"
-      ]
-    },
-    {
-      "groupName": "log4j",
-      "matchPackageNames": [
-        "org.apache.logging.log4j*"
-      ]
-    },
-    {
-      "groupName": "apache-commons",
-      "matchPackageNames": [
-        "org.apache.commons:*",
-        "commons-*"
-      ]
-    },
-    {
-      "groupName": "test-tooling",
-      "matchPackageNames": [
-        "org.mockito*",
-        "net.bytebuddy*",
-        "org.objenesis:*",
-        "org.hamcrest:*",
-        "junit:*"
-      ]
     }
   ]
 }