diff --git a/README.md b/README.md
index 05f26ac..754140a 100644
--- a/README.md
+++ b/README.md
@@ -7,18 +7,19 @@ This repo runs [Renovate](https://docs.renovatebot.com/) via **Gitea Actions**,
 - **Gitea Actions** runs a single job from `.gitea/workflows/renovate.yml` on a **cron schedule** and on **manual dispatch**.
 - The job uses the official `renovatebot/github-action` and reads config from **renovate.json** in this repo.
 - Renovate processes every non-mirror Gitea repo the bot token can access (push/pull, PRs enabled), opening and updating PRs. Minor and patch updates are grouped into one PR per repo; major updates use separate PRs.
+- Dependencies with known OSV vulnerabilities get their own PRs labeled `security`. They still wait out `minimumReleaseAge` like everything else, so a poisoned release can't land instantly.
 
 ## Setup
 
 ### 1. Gitea Actions workflow & schedule
 
-The workflow lives in `.gitea/workflows/renovate.yml` and currently runs every 6 hours:
+The workflow lives in `.gitea/workflows/renovate.yml` and currently runs every hour:
 
 ```yaml
 on:
   workflow_dispatch:
   schedule:
-    - cron: "0 */6 * * *"
+    - cron: "0 * * * *"
 ```
 
 To change the schedule (e.g. daily or weekly), edit the cron expression there and push a commit.
@@ -43,9 +44,16 @@ Create a dedicated Renovate bot user in Gitea (or your IdP) so PRs and commits a
 3. Copy the token (shown only once) and store it as the `RENOVATE_TOKEN` secret for this repo (or org) in Gitea Actions.
 4. In **renovate.json**, set `gitAuthor` to match the bot (e.g. `"Renovate Bot <renovate-bot@your-domain>"`).
 
+### 4. Labels
+
+Create these labels on the repos (or org-wide) so Renovate can apply them:
+
+- `dependencies` — all update PRs
+- `security` — vulnerability-driven PRs
+
 ## Configuration
 
-Renovate is configured in **renovate.json**. It sets the platform, autodiscovery, grouping (`group:allNonMajor`), best-practices presets, and disables the Dependency Dashboard via the `:disableDependencyDashboard` preset (so it stays off even if other presets enable it). Token and endpoint are provided only via environment (secrets).
+Renovate is configured in **renovate.json**. It sets the platform, autodiscovery, grouping (`group:allNonMajor`), best-practices presets, OSV vulnerability alerts, abandoned-package reporting, PR rate limits, and disables the Dependency Dashboard via the `:disableDependencyDashboard` preset (so it stays off even if other presets enable it). Token and endpoint are provided only via environment (secrets).
 
 **Target repos:** If a repo has its own **renovate.json**, it is merged on top of this global config. A repo that sets its own `extends` (e.g. `"extends": ["config:recommended"]`) can effectively replace the global presets, lose grouping, or re-enable the dashboard. To keep bundled PRs and no dashboard, either omit per-repo configs or ensure they do not override `extends` / dashboard settings.
 
diff --git a/renovate.json b/renovate.json
index ec4e140..299cbf8 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,7 +3,8 @@
     "config:recommended",
     ":configMigration",
     "group:allNonMajor",
-    ":disableDependencyDashboard"
+    ":disableDependencyDashboard",
+    "abandonments:recommended"
   ],
   "gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
   "semanticCommits": "enabled",
@@ -12,6 +13,14 @@
   "prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
   "minimumReleaseAge": "3 days",
   "rangeStrategy": "auto",
+  "labels": ["dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security", "dependencies"]
+  },
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 5,
   "dockerfile": {
     "digest": { "enabled": false }
   },