diff --git a/.github/renovate.json b/.github/renovate.json
index 8d459f5e..18e73171 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -35,6 +35,8 @@
         "^actions/github-script",
         "^actions/setup-go",
         "^actions/upload-artifact",
+        "^docker/setup-buildx-action",
+        "^docker/setup-qemu-action",
         "^dorny/paths-filter",
         "^github/codeql-action",
         "^golang/govulncheck-action",
@@ -45,7 +47,26 @@
         "^micnncim/action-label-syncer",
         "^ossf/scorecard-action"
       ],
-      "groupName": "dependencies for github"
+      "groupName": "Github action dependencies"
+    },
+    {
+      "matchPackagePatterns": [
+        "^kubernetes",
+        "^k8s.io/client-go",
+        "^sigs.k8s.io/controller-runtime",
+        "^sigs.k8s.io/controller-tools"
+      ],
+      "groupName": "Kubernetes runtime dependencies"
+    },
+    {
+      "matchPackagePatterns": [
+        "^cert-manager/cert-manager",
+        "^github.com/elastic/crd-ref-docs",
+        "^google",
+        "^google-beta",
+        "^hashicorp/terraform"
+      ],
+      "groupName": "Build Tools"
     }
   ],
   "force": {
diff --git a/.github/trusted-contribution.yml b/.github/trusted-contribution.yml
index 0c42519c..4fd6a9c7 100644
--- a/.github/trusted-contribution.yml
+++ b/.github/trusted-contribution.yml
@@ -14,6 +14,6 @@
 
 annotations:
   - type: label
-    text: "tests: run"
+    text: "tests: run-unit"
 
 trustedContributors: ['renovate-bot', 'gcf-merge-on-green[bot]']
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 4a1b4e90..1b9db01c 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -21,7 +21,7 @@ on:
 permissions: read-all
 jobs:
   unit:
-    if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
+    if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' || github.event.label.name == 'tests: run-unit' }}"
     name: unit tests
     runs-on: ubuntu-latest
     permissions:
@@ -29,7 +29,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Remove PR Label
-        if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
+        if: "${{ github.event.action == 'labeled' && (github.event.label.name == 'tests: run' || github.event.label.name == 'tests: run-unit') }}"
         uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}