diff --git a/.github/renovate.json5 b/.github/renovate.json5
index f1c4575..375ae0f 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -178,9 +178,9 @@
 
     {
       matchManagers: ["maven", "gradle"],
-      matchPackagePrefixes: [
-        "org.springframework",
-        "org.springframework.security"
+      matchPackageNames: [
+        "org.springframework{/,}**",
+        "org.springframework.security{/,}**"
       ],
       groupName: "spring ecosystem",
       addLabels: ["renovate-type-spring"],
@@ -305,7 +305,7 @@
     {
       matchManagers: ["maven", "gradle"],
       groupName: "{{groupId}} packages",
-      matchPackagePatterns: [".*"],
+      matchPackageNames: ["/.*/"],
     }
   ],
 }
diff --git a/.github/workflows/common-validate-renovate.yml b/.github/workflows/common-validate-renovate.yml
index 8d9ca11..ea975de 100644
--- a/.github/workflows/common-validate-renovate.yml
+++ b/.github/workflows/common-validate-renovate.yml
@@ -30,4 +30,4 @@ jobs:
           docker run --rm \
             -v "$GITHUB_WORKSPACE:/repo" \
             "renovate/renovate:$VERSION" \
-            renovate-config-validator "/repo/$CONFIG_PATH"
+            renovate-config-validator --strict "/repo/$CONFIG_PATH"
diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml
index 3b03023..2f60b6a 100644
--- a/.github/workflows/validate-renovate.yml
+++ b/.github/workflows/validate-renovate.yml
@@ -4,9 +4,14 @@ on:
   push:
     paths:
       - ".github/renovate.json5"
+      # so a change to the check itself is exercised by the check
+      - ".github/workflows/validate-renovate.yml"
+      - ".github/workflows/common-validate-renovate.yml"
   pull_request:
     paths:
       - ".github/renovate.json5"
+      - ".github/workflows/validate-renovate.yml"
+      - ".github/workflows/common-validate-renovate.yml"
 
 permissions: {}