diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index f07e3ad..e2648ab 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -2,6 +2,9 @@ name: build-and-publish
 on:
   push:
     branches: [main]
+    # Files that can't change the image. Skipping them avoids a pointless rebuild that Watchtower
+    # would then redeploy — a few seconds of downtime on a live site for a docs-only commit.
+    paths-ignore: ["renovate.json", "**.md"]
   # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
   # instead of waiting for a Renovate bump PR).
   workflow_dispatch:
diff --git a/renovate.json b/renovate.json
index 73fce27..10c013f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -7,6 +7,12 @@
       "matchPackageNames": ["net.thebennett.platform:**"],
       "groupName": "bennett platform",
       "automerge": true
+    },
+    {
+      "description": "Stay on Testcontainers 1.x. 2.0 renamed the module artifacts (postgresql, junit-jupiter), so the major bump doesn't just fail the build — its POM won't even parse. Revisit deliberately, not via a bot PR.",
+      "matchPackageNames": ["org.testcontainers:**"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
     }
   ],
   "vulnerabilityAlerts": {