diff --git a/.github/renovate.json b/.github/renovate.json
index 230da6d..70bff15 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,8 +1,22 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "enabledManagers": ["nuget", "github-actions", "terraform"],
+  "enabledManagers": ["nuget", "github-actions", "terraform", "custom.regex"],
+  "schedule": ["before 6am every weekday"],
   "minimumReleaseAge": "3 days",
   "internalChecksFilter": "strict",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": [
+        "EF_VERSION in the Elastic Beanstalk packaging script installs dotnet-ef at deploy time and must move with the tool manifest and EF Core packages"
+      ],
+      "managerFilePatterns": ["/^scripts/package-elastic-beanstalk\\.sh$/"],
+      "matchStrings": ["EF_VERSION=\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""],
+      "datasourceTemplate": "nuget",
+      "depNameTemplate": "dotnet-ef",
+      "versioningTemplate": "nuget"
+    }
+  ],
   "packageRules": [
     {
       "description": [
@@ -12,8 +26,10 @@
       "dependencyDashboardApproval": true
     },
     {
-      "description": ["Group non-major nuget updates"],
-      "matchManagers": ["nuget"],
+      "description": [
+        "Group non-major nuget updates, including the dotnet-ef pin in the packaging script"
+      ],
+      "matchManagers": ["nuget", "custom.regex"],
       "matchUpdateTypes": ["minor", "patch"],
       "groupName": "nuget minor and patch"
     },
@@ -35,6 +51,18 @@
       "matchUpdateTypes": ["major"],
       "groupName": "aspnetcore and ef core"
     },
+    {
+      "description": [
+        "net8.0 target: hold ASP.NET Core, EF Core, and dotnet-ef at 8.x until the TargetFramework moves; the group above takes over then"
+      ],
+      "matchPackageNames": [
+        "Microsoft.AspNetCore{/,}**",
+        "Microsoft.EntityFrameworkCore{/,}**",
+        "dotnet-ef"
+      ],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
     {
       "description": ["Keep AWS SDK majors together"],
       "matchPackageNames": ["/^AWSSDK\\./"],