diff --git a/renovate-config.json b/renovate-config.json
index 6b1f11c..f768195 100644
--- a/renovate-config.json
+++ b/renovate-config.json
@@ -24,6 +24,13 @@
       "groupName": "Go modules (minor and patch)",
       "groupSlug": "go-modules-minor-patch"
     },
+    {
+      "description": "Do not propose k8s.io/kube-openapi revisions on their own. A new revision can require a structured-merge-diff major that the pinned k8s.io/apimachinery cannot build against, which fails every Go modules group it joins. go mod tidy moves it when the k8s.io modules move.",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": ["k8s.io/kube-openapi"],
+      "matchUpdateTypes": ["digest"],
+      "enabled": false
+    },
     {
       "description": "Group every npm package minor and patch update in a repository into one pull request, so the dashboard asks for one approval per repository instead of one per package.",
       "matchManagers": ["npm", "bun"],