diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 300ee6f..3aa2f0d 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -30,6 +30,17 @@
       ],
       groupName: 'github actions',
     },
+    {
+      // keep Kotlin Gradle plugin updates out of the catch-all patch PR because CodeQL often
+      // fails on them, which blocks unrelated patch updates
+      matchDepNames: [
+        'org.jetbrains.kotlin.jvm',
+      ],
+      schedule: [
+        '* 0-7 * * 2', // weekly, before 8am on Tuesday
+      ],
+      groupName: 'kotlin plugin updates',
+    },
 
     // ── Disabled updates ───────────────────────────────────────────────