diff --git a/default.json b/default.json
index 5fd8de5..53429b4 100644
--- a/default.json
+++ b/default.json
@@ -58,6 +58,23 @@
       ],
       "enabled": false
     },
+    {
+      "description": "Keep every image in cplieger/docs on a plain tag. Each compose file under examples/ is shown verbatim inside a docs/*.md page, and scripts/snippets.py --check fails when the two differ. config:best-practices pins digests (docker:pinDigests), but the docs/*.md custom manager below has no digest group, so a bump wrote `traefik:v3.7.14@sha256:...` into the example and `traefik:v3.7.14` into the page and turned main red (docs#9). Tags are also what a reader should copy: the images guide recommends a tag that keeps updating and treats a digest as an opt-in the reader's own Renovate maintains. tests/ follows suit because the Examples workflow deliberately runs the current :latest app images and upstreams; a digest there would only add a bump PR per upstream rebuild. A later packageRule wins, so this overrides the preset's digest pinning.",
+      "matchRepositories": [
+        "cplieger/docs"
+      ],
+      "pinDigests": false
+    },
+    {
+      "description": "No digest pinning for the image lines the docs/*.md custom manager reads. Its matchString has no currentDigest group, so it can move a tag but never write a digest: with config:best-practices' pinDigests on, every docs page image line became a pinDigest update that cannot be applied, and the grouped renovate/pin-dependencies branch errored and retried on every run (cplieger/docs' Dependency Dashboard). The copy follows its compose file, which stays tag-only where a page shows it (the rule above).",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchFileNames": [
+        "docs/*.md"
+      ],
+      "pinDigests": false
+    },
     {
       "description": "Never update the dependencies of a test fixture's manifest. deadset-ts's fixtures/ and deadset-spec's corpus/fixtures/ hold package.json files that are inputs to the analyzer under test (a dependency declared and never imported, an installed copy that is only types, a bin no import reaches), and their names and versions are what the tests assert, so a bump changes a test's subject rather than a dependency of the repository. Several of the names also exist on the registry (left-pad, dev-tool), so without this rule Renovate proposes updates to packages the repository never installs. Scoped by repository and path so no other repo's fixtures are affected.",
       "matchRepositories": [