diff --git a/.github/actions/process-artifacts/action.yml b/.github/actions/process-artifacts/action.yml
index 77c6c9f2..73a41c9d 100644
--- a/.github/actions/process-artifacts/action.yml
+++ b/.github/actions/process-artifacts/action.yml
@@ -69,7 +69,11 @@ runs:
              "$(which VCRUNTIME140.dll)" \
              ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }}
         # fi
-        cd ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }} && mv vc_x64_dll/* .
+        # wxWidgets installs its DLLs into a per-compiler subdir under bin/ (e.g. vc_x64_dll).
+        # Flatten them next to the executable. Guard the move: the subdir may be missing or
+        # empty depending on the wxWidgets version (the layout changed after v3.3.1), and an
+        # unguarded `mv dir/* .` fails with "cannot stat" when the glob matches nothing.
+        cd ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }} && shopt -s nullglob && if compgen -G "vc_x64_dll/*" > /dev/null; then mv -f vc_x64_dll/* . ; fi && rmdir vc_x64_dll 2>/dev/null || true
 
     - name: Copy stdlib (MinGW)
       shell: bash
@@ -80,4 +84,5 @@ runs:
           gcc/mingw64/bin/libgcc_s_seh-1.dll \
           gcc/mingw64/bin/libwinpthread-1.dll \
           ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }}
-        cd ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }} && mv gcc_x64_dll/* .
+        # See the MSVC step above for why the move is guarded.
+        cd ${GITHUB_WORKSPACE}/${{ env.ZIP_NAME }} && shopt -s nullglob && if compgen -G "gcc_x64_dll/*" > /dev/null; then mv -f gcc_x64_dll/* . ; fi && rmdir gcc_x64_dll 2>/dev/null || true
diff --git a/.github/config/renovate-deps.json b/.github/config/renovate-deps.json
index e693caca..9971469c 100644
--- a/.github/config/renovate-deps.json
+++ b/.github/config/renovate-deps.json
@@ -40,17 +40,29 @@
     },
     {
       "customType": "regex",
-      "description": "Update SFML commented SHA",
+      "description": "Keep the commented '# GIT_TAG <sha> # <tag>' pin in sync with the newest tag",
       "managerFilePatterns": ["CMakeLists.txt"],
       "matchStrings": [
         "# renovate: depName=(?<depName>\\S+)\\s+# GIT_TAG\\s+(?<currentDigest>[a-z0-9]{40}) # (?<currentValue>\\S+)"
       ],
-      "datasourceTemplate": "git-refs",
+      "datasourceTemplate": "git-tags",
       "depNameTemplate": "{{{depName}}}",
       "packageNameTemplate": "https://github.com/{{{depName}}}",
       "versioningTemplate": "loose"
     }
   ],
+  "packageRules": [
+    {
+      "matchDepNames": ["wxWidgets/wxWidgets"],
+      "description": "Keep the wx tag bump and the commented # GIT_TAG SHA in a single PR (Renovate otherwise splits digest updates onto their own <name>-digest branch)",
+      "groupName": "Update wxWidgets"
+    },
+    {
+      "matchDepNames": ["SFML/SFML"],
+      "description": "Keep the SFML tag bump and the commented # GIT_TAG SHA in a single PR (Renovate otherwise splits digest updates onto their own <name>-digest branch)",
+      "groupName": "Update SFML"
+    }
+  ],
   "prConcurrentLimit": 0,
   "prHourlyLimit": 0
 }
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index b3d06bee..8d2b6c34 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -34,7 +34,7 @@ env:
   APP_WINDOW: "My Window"
   # NOTE: also update in CMakeLists FetchContent
   # renovate: datasource=github-tags depName=wxWidgets/wxWidgets versioning=loose
-  WX_VERSION: "v3.3.1"
+  WX_VERSION: "v3.3.3.1"
 
 defaults:
   run:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 363f5994..7bfa44b5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -35,9 +35,9 @@ FetchContent_Declare(
     SYSTEM
     GIT_REPOSITORY https://github.com/wxWidgets/wxWidgets.git
     # renovate: datasource=github-tags depName=wxWidgets/wxWidgets versioning=loose
-    GIT_TAG        v3.3.1
+    GIT_TAG        v3.3.3.1
     # renovate: depName=wxWidgets/wxWidgets
-    # GIT_TAG        1f9535fbb666c6e89820eb36c38c7143f534cb38 # v3.3.1
+    # GIT_TAG        565553ee980e925bbd8b3cdaeea0eb9f453d7dfd # v3.3.3.1
     GIT_SHALLOW    1  # works only with branches or tags, not with arbitrary commit hashes
     GIT_PROGRESS   ON
 )
diff --git a/README.md b/README.md
index 2cc92bc4..551a0654 100644
--- a/README.md
+++ b/README.md
@@ -194,5 +194,5 @@ The [template repository](https://github.com/mcmarius/oop-template) itself is li
 
 ## Resurse
 <!-- renovate: datasource=github-tags depName=wxWidgets/wxWidgets versioning=loose -->
-- [wxWidgets](https://github.com/wxWidgets/wxWidgets/tree/v3.3.1) (wxWindows Library Licence ~ LGPL)
+- [wxWidgets](https://github.com/wxWidgets/wxWidgets/tree/v3.3.3.1) (wxWindows Library Licence ~ LGPL)
 - adăugați trimiteri **detaliate** către resursele externe care v-au ajutat sau pe care le-ați folosit