diff --git a/renovate.json b/renovate.json
index 2f2166e..f8407c0 100644
--- a/renovate.json
+++ b/renovate.json
@@ -90,14 +90,14 @@
     {
       "description": "Low-privilege actions: grouped, standard cooldown",
       "matchManagers": ["github-actions"],
-      "excludePackageNames": [
-        "pypa/gh-action-pypi-publish",
-        "hynek/build-and-inspect-python-package",
-        "codecov/codecov-action",
-        "actions/checkout",
-        "googleapis/release-please-action"
-      ],
-      "groupName": "github actions (low-privilege)"
+      "groupName": "github actions (low-privilege)",
+      "matchPackageNames": [
+        "!pypa/gh-action-pypi-publish",
+        "!hynek/build-and-inspect-python-package",
+        "!codecov/codecov-action",
+        "!actions/checkout",
+        "!googleapis/release-please-action"
+      ]
     },
     {
       "description": "Automerge non-major dev/lint dependency updates (skip 0.x)",