diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 2784274..0da6d46 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -140,12 +140,28 @@ jobs:
           # Docker Hub account (and 5000+/day with paid). hostRules with
           # matchHost: "index.docker.io" wires this in for Renovate.
           # https://docs.renovatebot.com/configuration-options/#hostrules
+          # Two hostRules:
+          #   - index.docker.io: see comment block above; opt-out of the
+          #     anonymous 100/6h pull rate limit.
+          #   - github.com:      explicit override so digest lookups for
+          #     cross-org actions (dagger/, sigstore/, renovatebot/,
+          #     ossf/, …) authenticate via the workflow's GITHUB_TOKEN
+          #     instead of the App-installation token, which is scoped
+          #     to enix/x509-certificate-exporter and is unreliable on
+          #     cross-org git/refs reads (Renovate logs them as
+          #     "Could not determine new digest for update"). The
+          #     platform token used to push branches and open PRs
+          #     stays the App token (set via the `token:` input below).
           RENOVATE_HOST_RULES: |
             [
               {
                 "matchHost": "index.docker.io",
                 "username": "${{ secrets.DOCKERHUB_READONLY_USERNAME }}",
                 "password": "${{ secrets.DOCKERHUB_READONLY_TOKEN }}"
+              },
+              {
+                "matchHost": "github.com",
+                "token": "${{ github.token }}"
               }
             ]
           # Dry run only when explicitly requested via workflow_dispatch.