diff --git a/flake.nix b/flake.nix
index 3a81915..d51c8a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,12 +17,14 @@
         # source would require also setting up the JS toolchain.
         # Acceptable trade-off for a dev/diagnostic tool.
         #
-        # Bump procedure (manual — Renovate can't refresh the four
-        # per-arch hashes on a `fetchurl` bump):
+        # Bump procedure (Renovate proposes `version` bumps via the regex
+        # manager in renovate.json5, but cannot recompute the four
+        # per-arch hashes on a `fetchurl` bump — refresh those by hand):
         #   1. update `version` below
         #   2. curl -sL https://github.com/Zxilly/go-size-analyzer/releases/download/v<v>/checksums.txt
         #   3. for each (arch, hex) pair: hash = "sha256-$(echo <hex> | xxd -r -p | base64)"
         goSizeAnalyzer = let
+          # gsa version
           version = "1.12.6";
           assets = {
             "x86_64-linux"   = { suffix = "linux_amd64";  hash = "sha256-k8NBdryks8GIFpADqs0Er0uLXK9BOfg8th01GnVaILA="; };
diff --git a/renovate.json5 b/renovate.json5
index 9841877..ff43322 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -197,11 +197,17 @@
     // goreleaser/goreleaser-action in release.yaml. The github-actions
     // manager SHA-pins the action ref itself but doesn't parse arbitrary
     // `with:` values, so a separate regex manager is needed.
+    //
+    // Anchored on the action name (same shape as the setup-helm manager
+    // below) — an unanchored `version: "vX"` would claim ANY v-prefixed
+    // version field in the file as goreleaser's and rewrite it to
+    // goreleaser releases. It only ever worked unanchored because
+    // setup-helm's value happens to lack the `v` prefix.
     {
       customType: "regex",
       managerFilePatterns: ["/^\\.github/workflows/release\\.ya?ml$/"],
       matchStrings: [
-        "version:\\s*\"(?<currentValue>v\\d[\\w.-]*)\"",
+        "goreleaser-action[^\\n]+\\n\\s+with:\\n\\s+version:\\s*\"(?<currentValue>v\\d[\\w.-]*)\"",
       ],
       depNameTemplate: "goreleaser/goreleaser",
       datasourceTemplate: "github-releases",
@@ -222,6 +228,21 @@
       datasourceTemplate: "github-releases",
       extractVersionTemplate: "^v(?<version>.*)$",
     },
+    // go-size-analyzer pinned in flake.nix, same recipe as goreleaser
+    // above: Renovate proposes the version bump, the four per-arch
+    // fetchurl hashes are refreshed by hand (procedure in the flake
+    // comment). Without this manager no bump is ever even *proposed* —
+    // the version only moves when someone thinks of it.
+    {
+      customType: "regex",
+      managerFilePatterns: ["/^flake\\.nix$/"],
+      matchStrings: [
+        "# gsa version\\s*\\n\\s*version\\s*=\\s*\"(?<currentValue>\\d[\\w.-]*)\"",
+      ],
+      depNameTemplate: "Zxilly/go-size-analyzer",
+      datasourceTemplate: "github-releases",
+      extractVersionTemplate: "^v(?<version>.*)$",
+    },
     // Helm version pinned inside the `with: version:` field of
     // azure/setup-helm in release.yaml (same blind spot as goreleaser above).
     {
@@ -298,9 +319,12 @@
       dependencyDashboardApproval: true,
     },
 
-    // Group all variant base images (busybox, alpine, registry) together.
+    // Group all variant base images together: busybox (the shell-enabled
+    // image variant's Dockerfile) and alpine (dagger/base.go's
+    // `alpineImage`). Only images actually present in the tree belong
+    // here — a stale entry reads as "this is tracked" when nothing is.
     {
-      matchPackageNames: ["busybox", "alpine", "registry"],
+      matchPackageNames: ["busybox", "alpine"],
       groupName: "container base images",
       labels: ["dependencies", "docker"],
     },