diff --git a/README.md b/README.md
index c2a5556..2e7fc12 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,9 @@ Each chart renders its main image as `<repo>:{{ .Chart.AppVersion }}` — reposi
 
 A consequence of pinning every tag in `values.yaml`: `ci/renovate-bump-chart.sh` sees an unchanged `appVersion` and bumps the chart **patch**. That holds for all nine images alike — none of them is special — and it is the intended outcome, since `appVersion` here is the chart's own marker rather than a tracked upstream version.
 
-One dependency is constrained beyond its versioning: **nginx** (the Synapse delegation sidecar) is limited to **even minors** via `allowedVersions`. nginx numbers its release branches by minor — even is stable, odd is mainline — and the chart belongs on stable. Patch updates inside the stable branch still flow through normally. The constraint tolerates a variant suffix (`1.30.4-alpine`) on purpose: docker versioning only ever offers candidates carrying the current tag's suffix, so a suffix-blind constraint would silently freeze nginx the day the sidecar moves to a slimmer base image — a switch to `1.30.4-alpine` that #84 has commissioned a check on — with no error and no warning.
+Two dependencies are constrained beyond their versioning. **nginx** (the Synapse delegation sidecar) is limited to **even minors** via `allowedVersions`. nginx numbers its release branches by minor — even is stable, odd is mainline — and the chart belongs on stable. Patch updates inside the stable branch still flow through normally. The constraint tolerates a variant suffix (`1.30.4-alpine`) on purpose: docker versioning only ever offers candidates carrying the current tag's suffix, so a suffix-blind constraint would silently freeze nginx the day the sidecar moves to a slimmer base image — a switch to `1.30.4-alpine` that #84 has commissioned a check on — with no error and no warning.
+
+**linuxserver/qbittorrent** (freesailarr) excludes two tags by name, `14.3.9` and `20.04.1`. They are leftovers from earlier linuxserver tagging schemes, and docker versioning sorts both above every real release, so Renovate offers them as major updates — PRs #152 and #153 were exactly that. They are named rather than cut off with an upper bound like `<10`, because a bound would eventually reject a genuine major, while two finished artifacts cannot grow and therefore cannot hide a future release. The same guard as for nginx applies and was run: a lookup from `currentValue 4.6.4` still offers `5.2.3` as a **major**, so the filter does not silently empty the update list. That fixture also shows the cost of leaving it alone — without the rule the very same lookup offers `20.04.1` and never mentions the real `5.2.3`, since Renovate fills the major bucket only once.
 
 Not managed: `ci/**` (install-test fixtures pin throwaway infrastructure to major lines on purpose) and `template-chart/**` (placeholder image). A consequence worth knowing: `ci/matrix-synapse/fixtures.yaml` pins a Synapse image that Renovate will not follow — bump it by hand when the chart moves a major.
 
diff --git a/renovate.json5 b/renovate.json5
index e400c1f..c5c483b 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -119,6 +119,37 @@
       // "updates": [] and "warnings": [].
       allowedVersions: "/^\\d+\\.\\d*[02468]\\.\\d+(-.+)?$/",
     },
+    {
+      description: [
+        "linuxserver/qbittorrent carries two historic tags from earlier tagging schemes,",
+        "14.3.9 and 20.04.1, which docker versioning sorts above every real release and",
+        "offers as major updates — PRs #152 and #153 are exactly those. Both are excluded",
+        "by name.",
+      ],
+      matchDatasources: ["docker"],
+      matchPackageNames: [
+        "linuxserver/qbittorrent",
+        "docker.io/linuxserver/qbittorrent",
+      ],
+      // Excluded by name rather than by a bound such as "<10": the strays are
+      // finished artifacts that cannot grow, so naming them can never block a
+      // release that does not exist yet, while any upper bound would sooner or
+      // later reject a genuine major. Shape-based filters were measured and
+      // rejected too: requiring a non-padded minor removes 20.04.1 and leaves
+      // 14.3.9 (verified, the lookup then offers 14.3.9 instead).
+      //
+      // Verified with renovate 44.41.0 (dry-run=lookup, real registry), two
+      // fixtures against the live tag list:
+      //   currentValue 5.2.1 -> updates [5.2.3 (patch)]; both strays gone.
+      //   currentValue 4.6.4 -> updates [4.6.7 (patch), 5.2.3 (major)].
+      // The second fixture is the guard the nginx rule taught us to run: it
+      // proves a genuine major still comes through instead of the filter
+      // silently emptying the update list. It also shows what the strays cost
+      // today — without the rule that same lookup offers 20.04.1 as the major
+      // candidate and never mentions the real 5.2.3, because Renovate fills
+      // the major bucket once.
+      allowedVersions: "!/^(14\\.3\\.9|20\\.04\\.1)$/",
+    },
   ],
 
   customManagers: [