diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ab281ae2..63722ed3 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -12,6 +12,9 @@
 // *******************************************************************************
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  // Only the self-hosted daily job has permission to run post-upgrade tasks.
+  // It overrides this setting with RENOVATE_FORCE to avoid competing runners.
+  "enabled": false,
   "extends": [
     "config:base",
     ":dependencyDashboard",
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 41c6211c..af42343a 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -45,10 +45,11 @@ jobs:
         with:
           # Pull requests from forks do not have access to secrets
           token: ${{ secrets.RENOVATE_TOKEN }}
-          configurationFile: .github/renovate.json5
         env:
           LOG_LEVEL: debug
           RENOVATE_REPOSITORIES: ${{ github.repository }}
+          # Enable only this runner; repository config disables other instances.
+          RENOVATE_FORCE: '{"enabled": true}'
           # Allow the post-upgrade tasks that refresh lockfile URLs and sha256
           # digests and re-sync the generated tool table in tools/README.md
           # (allowedCommands is a global-only option, so it must be set here