diff --git a/.github/renovate.json b/.github/renovate.json
index d752477..b4ce6a2 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,10 +1,32 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:recommended",
     ":disableDependencyDashboard"
   ],
   "ignorePaths": [
     "**/tests/**"
+  ],
+  "packageRules": [
+    {
+      "description": "Track only HAProxy LTS branches. Upstream ships LTS on even minors (3.0, 3.2, 3.4, ...) with ~5 years of support; odd minors (3.1, 3.3, ...) are non-LTS and go EOL about a year after release. See https://www.haproxy.org/ for branch status.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["docker.io/library/haproxy", "haproxy"],
+      "allowedVersions": "/^\\d+\\.\\d*[02468](\\.\\d+)?(-alpine.*)?$/",
+      "groupName": "haproxy base image"
+    },
+    {
+      "description": "A HAProxy minor bump can change SPOP mux behaviour, which the pinned haproxy-python-spoa commit compensates for. Keep those PRs separate from routine patch bumps so the SPOE agent gets tested against the new branch.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["docker.io/library/haproxy", "haproxy"],
+      "matchUpdateTypes": ["major", "minor"],
+      "groupName": "haproxy LTS branch upgrade",
+      "addLabels": ["needs-spoe-testing"]
+    },
+    {
+      "description": "Group GitHub Actions bumps into a single PR.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
   ]
 }
diff --git a/Dockerfile b/Dockerfile
index ff77765..caf103f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,7 @@
 #  - HP_SHARED_KEY or HP_SHARED_KEY_FILE must be provided at runtime.
 # -------------------------------------------------------------------------
 
-FROM docker.io/library/haproxy:3.2.22-alpine3.24
+FROM docker.io/library/haproxy:3.4.4-alpine3.24
 
 USER root
 
@@ -67,8 +67,8 @@ RUN set -ex; \
 
 # Install the Python SPOA library.
 # Pinned to a commit: the single-write frame emission it contains is required for
-# HAProxy 3.2+, whose SPOP mux resets connections when a frame arrives split
-# across TCP segments. Bump this deliberately together with the library.
+# HAProxy 3.2+ (we run 3.4 LTS), whose SPOP mux resets connections when a frame
+# arrives split across TCP segments. Bump this deliberately together with the library.
 RUN pip install --break-system-packages \
         pydantic==2.13.4 \
         git+https://github.com/cloud-py-api/haproxy-python-spoa.git@f00f3f7b1b0f56e10052af6c0d07e81c5195d84d
diff --git a/development/debugging/Dockerfile b/development/debugging/Dockerfile
index e6651df..cef1ab8 100644
--- a/development/debugging/Dockerfile
+++ b/development/debugging/Dockerfile
@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-FROM haproxy:3.2.22-alpine3.24
+FROM haproxy:3.4.4-alpine3.24
 
 USER root