diff --git a/.github/renovate.json b/.github/renovate.json
index 1b653e3bb..d601959f0 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -66,18 +66,6 @@
       ],
       "allowedVersions": "/^v0\\./"
     },
-    {
-      "description": "Automerge version bumps of roles maintained in the MASH organization and of devture roles (via branch push - no PR)",
-      "matchManagers": [
-        "ansible-galaxy"
-      ],
-      "matchSourceUrls": [
-        "https://github.com/devture/com.devture.ansible.role{/,}**",
-        "https://github.com/mother-of-all-self-hosting{/,}**"
-      ],
-      "automerge": true,
-      "automergeType": "branch"
-    },
     {
       "description": "Housekeeping updates merge via branch push (no PR, no email); a failure on the branch still surfaces as a PR. i18n/requirements.txt bumps are exercised by the Matrix i18n workflow before merging.",
       "matchFileNames": [
diff --git a/docs/renovate.md b/docs/renovate.md
index 0636e17a2..2bdfccd66 100644
--- a/docs/renovate.md
+++ b/docs/renovate.md
@@ -4,6 +4,13 @@ SPDX-FileCopyrightText: 2026 Slavi Pantaleev
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
+# Reviewing role dependency updates
+
+Renovate opens pull requests for Ansible role version updates instead of merging their branches
+directly. Review the released role changes and the playbook wiring before merging; a role update may
+need a playbook adaptation even when its role tests pass. Other dependency classes retain their
+separate Renovate policies.
+
 # Maintaining the Renovate runner
 
 The self-hosted runner version is pinned in [`.github/workflows/renovate.yml`](../.github/workflows/renovate.yml). Renovate updates this pin and automerges passing updates according to [`.github/renovate.json`](../.github/renovate.json).