diff --git a/renovate.json b/renovate.json
index 61cb4263f..26a6ef1b3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,10 +1,10 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ],
+  "extends": ["config:recommended"],
   "timezone": "Europe/Berlin",
   "schedule": ["* 0-5 * * *"],
+  "minimumReleaseAge": "14 days",
+  "internalChecksFilter": "strict",
   "labels": [
     "bot",
     "renovate",
@@ -27,6 +27,13 @@
       "groupName": "GitHub Actions",
       "matchManagers": ["github-actions"],
       "separateMajorMinor": false
+    },
+    {
+      "matchVulnerabilities": true,
+      "minimumReleaseAge": null,
+      "schedule": ["at any time"],
+      "groupName": "security fixes",
+      "addLabels": ["security", "urgent"]
     }
   ]
-}
\ No newline at end of file
+}