diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 6ae5642..3143dbf 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -5,9 +5,11 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended",             // Use recommended settings
+    "docker:pinDigests",              // Pin container digests
     "helpers:pinGitHubActionDigests", // Pin GitHub action digests
     ":enablePreCommit",               // Enable updates to pre-commit repos
-    ":gitSignOff"                     // Add Signed-off-by line to commit messages
+    ":gitSignOff",                    // Add Signed-off-by line to commit messages
+    ":pinDevDependencies"             // Pin dev dependencies also
   ],
   // Files to ignore
   // "ignorePaths": [
@@ -18,13 +20,6 @@
   ],
   "lockFileMaintenance": {"enabled": true},
   "packageRules": [
-    {
-      "description": "Update golang tag in dockerfile & golang version in workflows in a single PR",
-      "groupName": "golang version",
-      "matchDepNames": [
-        "^golang$"
-      ]
-    },
     {
       "description": "Update devcontainer images in a single PR",
       "groupName": "devcontainer",
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 5b92991..2822cfb 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -108,6 +108,10 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           # https://docs.docker.com/build/cache/backends/gha/
+          # Effect on build times (B&P step only):
+          #   No caching: 44s
+          #   Max mode, no cache: 79s
+          #   Max mode, perfect hit: 8s
           cache-from: type=gha
           cache-to: type=gha,mode=max