diff --git a/README.md b/README.md
index 101f9db..0f1b308 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,8 @@ What Renovate keeps current:
 
 Each chart renders its main image as `<repo>:{{ .Chart.AppVersion }}` — repository in the template, version in `Chart.yaml`. Renovate cannot join two files, so the mapping lives in `renovate.json5`, one block per chart. It is deliberately *not* a `# renovate:` comment inside each `Chart.yaml`: that would touch all chart directories and force a version bump plus a publish per chart for a pure comment change. Charts whose tags carry a flavour or date suffix (`apache-tika`, `minecraft-server`, `rss-bridge`, `teamspeak-server`) override `versioning` in their block; the reasoning sits next to each one.
 
+One dependency is constrained beyond its versioning: **nginx** (the Synapse delegation sidecar) is limited to **even minors** via `allowedVersions`. nginx numbers its release branches by minor — even is stable, odd is mainline — and the chart belongs on stable. Patch updates inside the stable branch still flow through normally.
+
 Not managed: `ci/**` (install-test fixtures pin throwaway infrastructure to major lines on purpose) and `template-chart/**` (placeholder image). A consequence worth knowing: `ci/matrix-synapse/fixtures.yaml` pins a Synapse image that Renovate will not follow — bump it by hand when the chart moves a major.
 
 ### The version-bump hook
diff --git a/renovate.json5 b/renovate.json5
index 220bf98..5ad07ba 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -97,6 +97,20 @@
       matchDepTypes: ["app-version"],
       addLabels: ["app-version"],
     },
+    {
+      description: [
+        "nginx numbers its release branches by minor: even is the stable branch, odd is",
+        "mainline. The Synapse delegation nginx belongs on stable, so only even minors are",
+        "allowed — that is what PR #139 (1.30.4 -> 1.31.4) would otherwise have done,",
+        "quietly moving the chart onto mainline. Patch updates inside the stable branch",
+        "(1.30.4 -> 1.30.5) still come through and still automerge.",
+      ],
+      matchDatasources: ["docker"],
+      matchPackageNames: ["nginx", "library/nginx", "docker.io/library/nginx"],
+      // Even minor: any minor whose last digit is even, so 1.30.x passes and
+      // 1.31.x does not.
+      allowedVersions: "/^\\d+\\.\\d*[02468]\\.\\d+$/",
+    },
   ],
 
   customManagers: [