diff --git a/.renovate/commitMessage.json5 b/.renovate/commitMessage.json5
index 8c70e940..ad17123c 100644
--- a/.renovate/commitMessage.json5
+++ b/.renovate/commitMessage.json5
@@ -27,35 +27,35 @@
       "matchUpdateTypes": ["!major"],
       "semanticCommitScope": "oci/{{#if groupName}}{{groupName}}{{else}}{{depName}}{{/if}}"
     },
-    {
-      "matchDatasources": ["docker"],
-      "matchDepNames": ["*/*"],
-      "matchUpdateTypes": ["!major"],
-      "semanticCommitScope": "oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 1 }}{{/if}}"
-    },
     {
       "matchDatasources": ["docker"],
       "matchDepNames": ["*/*/**"],
       "matchUpdateTypes": ["!major"],
       "semanticCommitScope": "oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 2 }}{{ lookup (split depName '/') 3 }}{{ lookup (split depName '/') 4 }}{{ lookup (split depName '/') 5 }}{{/if}}"
     },
+    {
+      "matchDatasources": ["docker"],
+      "matchDepNames": ["*/*"],
+      "matchUpdateTypes": ["!major"],
+      "semanticCommitScope": "oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 1 }}{{/if}}"
+    },
     {
       "matchDatasources": ["docker"],
       "matchUpdateTypes": ["major"],
       "commitMessagePrefix": "feat(oci/{{#if groupName}}{{groupName}}{{else}}{{depName}}{{/if}})!: "
     },
-    {
-      "matchDatasources": ["docker"],
-      "matchDepNames": ["*/*"],
-      "matchUpdateTypes": ["major"],
-      "commitMessagePrefix": "feat(oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 1 }}{{/if}})!: "
-    },
     {
       "matchDatasources": ["docker"],
       "matchDepNames": ["*/*/**"],
       "matchUpdateTypes": ["major"],
       "commitMessagePrefix": "feat(oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 2 }}{{ lookup (split depName '/') 3 }}{{ lookup (split depName '/') 4 }}{{ lookup (split depName '/') 5 }}{{/if}})!: "
     },
+    {
+      "matchDatasources": ["docker"],
+      "matchDepNames": ["*/*"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(oci/{{#if groupName}}{{groupName}}{{else}}{{ lookup (split depName '/') 1 }}{{/if}})!: "
+    },
     {
       "matchDatasources": ["github-releases", "github-tags"],
       "semanticCommitScope": "github/{{#if groupName}}{{groupName}}{{else}}{{depName}}{{/if}}"
diff --git a/.renovate/groups.json5 b/.renovate/groups.json5
index 5c39bc47..20939203 100644
--- a/.renovate/groups.json5
+++ b/.renovate/groups.json5
@@ -39,7 +39,7 @@
       "description": "Don't auto merge specific apps in path ./kube/deploy/apps",
       "matchPackagePatterns": ["reactive-resume", "home-assistant"],
       "automerge": false,
-      "matchFileNames": ["kube/deploy/apps/**"],
+      "matchFileNames": ["kube/deploy/apps/**"]
     },
     {
       "description": "Cilium Group",
@@ -48,7 +48,7 @@
       "versioning": "semver",
       "sourceUrl": "https://github.com/cilium/cilium",
       "separateMinorPatch": true,
-      "pinDigests": false,
+      "pinDigests": false
     },
     {
       "description": "Flux Group",
@@ -57,7 +57,7 @@
       "matchDatasources": ["docker", "github-tags"],
       "versioning": "semver",
       "separateMinorPatch": true,
-      "sourceUrl": "https://github.com/fluxcd/flux2",
+      "sourceUrl": "https://github.com/fluxcd/flux2"
     },
     {
       "description": "Flux Group (Automerge Patch)",
@@ -69,7 +69,7 @@
       "matchUpdateTypes": ["patch"],
       "automerge": true,
       "automergeType": "pr",
-      "rebaseWhen": "behind-base-branch",
+      "rebaseWhen": "behind-base-branch"
     },
     {
       "description": "authentik Group",
@@ -78,7 +78,7 @@
       "sourceUrl": "https://github.com/goauthentik/authentik",
       "automerge": false,
       "separateMultipleMajor": true,
-      "separateMinorPatch": true,
+      "separateMinorPatch": true
     },
     {
       "description": "Immich Group",
@@ -86,7 +86,24 @@
       "matchPackagePatterns": ["immich"],
       "versioning": "semver",
       "sourceUrl": "https://github.com/immich-app/immich",
-      "separateMinorPatch": true,
+      "separateMinorPatch": true
+    },
+    {
+      "description": "1Password Group",
+      "groupName": "1Password",
+      "matchPackagePatterns": ["1password"],
+      "versioning": "semver"
+    },
+    {
+      "description": "Talos",
+      "matchPackageNames": ["**siderolabs/installer"],
+      "overrideDepName": "{{{ replace 'installer' 'talos' depName }}}"
+    },
+    {
+      "description": "Kubernetes Group",
+      "groupName": "Kubernetes",
+      "matchPackagePatterns": ["kubelet", "kubectl", "kube-apiserver"],
+      "versioning": "semver"
     },
     {
       "description": "Manually approve app-template major releases",
@@ -98,7 +115,7 @@
       "separateMajorMinor": true,
       "separateMultipleMajor": true,
       "separateMinorPatch": true,
-      "groupName": "app-template-major",
+      "groupName": "app-template-major"
     },
     {
       "description": "Auto merge patch app-template versions",
@@ -112,7 +129,7 @@
       "separateMajorMinor": true,
       "separateMultipleMajor": true,
       "separateMinorPatch": true,
-      "groupName": "app-template-patch",
+      "groupName": "app-template-patch"
     },
     {
       "description": "Don't automerge app-template minor releases",
@@ -124,7 +141,7 @@
       "separateMajorMinor": true,
       "separateMultipleMajor": true,
       "separateMinorPatch": true,
-      "groupName": "app-template-minor",
+      "groupName": "app-template-minor"
     },
     {
       "description": "Miniflux enforce distroless images",
diff --git a/.renovate/security.json5 b/.renovate/security.json5
index d0614b64..1127d663 100644
--- a/.renovate/security.json5
+++ b/.renovate/security.json5
@@ -1,7 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "vulnerabilityAlerts": {
-    "labels": ["security"],
+    "addLabels": ["security"],
     "automerge": true,
     "automergeType": "branch",
     "schedule": ["at any time"],