diff --git a/renovate-shared-config.json b/renovate-shared-config.json
index 113fe97..d1868a4 100644
--- a/renovate-shared-config.json
+++ b/renovate-shared-config.json
@@ -100,15 +100,6 @@
       "timezone": "UTC",
       "updateNotScheduled": false
     },
-    // Ignore gh-aw managed workflow files — they are regenerated by the compiler.
-    {
-      "description": ["Ignore gh-aw managed workflow files"],
-      "matchFileNames": [
-        ".github/workflows/*.md",
-        ".github/workflows/*.lock.yml"
-      ],
-      "enabled": false
-    },
     // These files in these repos are synced from the bootc-dev/infra repository, which
     // sends PRs to update them. Ignoring them here to avoid conflicting Renovate updates.
     {
@@ -286,6 +277,25 @@
     {
       "matchDatasources": ["custom.rust-nightly"],
       "versioning": "rust-release-channel"
+    },
+    // Ignore gh-aw managed workflow files — they are regenerated by the compiler.
+    //
+    // These rules MUST stay last: later matching rules win, and the group
+    // rules above set "enabled": true, which would otherwise re-enable these.
+    {
+      "description": ["Ignore gh-aw managed workflow files"],
+      "matchFileNames": [
+        ".github/workflows/*.md",
+        ".github/workflows/*.lock.yml"
+      ],
+      "enabled": false
+    },
+    // gh-aw-actions versions are pinned and managed by the gh-aw compiler.
+    // See: https://github.github.com/gh-aw/reference/dependabot/#compiler-managed-gh-aw-actions-ignore-rule
+    {
+      "description": ["Ignore compiler-managed gh-aw actions"],
+      "matchPackageNames": ["github/gh-aw-actions{/,}**"],
+      "enabled": false
     }
   ]
 }