diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 3b802ac..83793d0 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -37,11 +37,11 @@ on:
         required: false
         type: boolean
         default: true
-      include-major:
-        description: "Put major updates in the batch. When false, each major update gets its own PR that is never merged automatically."
+      major-updates:
+        description: "What to do with major updates: 'ignore' skips them, 'separate' opens one PR per major that never merges automatically, 'batch' puts them in the batch."
         required: false
-        type: boolean
-        default: false
+        type: string
+        default: "ignore"
       minimum-release-age:
         description: "Skip releases younger than this, for example '2 days'"
         required: false
@@ -99,14 +99,14 @@ jobs:
       - name: Write Renovate config
         env:
           MIN_AGE: ${{ inputs.minimum-release-age }}
-          INCLUDE_MAJOR: ${{ inputs.include-major }}
+          MAJOR_UPDATES: ${{ inputs.major-updates }}
           CONFIG_FILE: ${{ runner.temp }}/renovate-autoupdate-config.json
         run: |
           jq -n \
             --arg repo "$GITHUB_REPOSITORY" \
             --arg age "$MIN_AGE" \
             --arg branch_prefix "${BATCH_BRANCH%%/*}/" \
-            --argjson include_major "$INCLUDE_MAJOR" \
+            --arg majors "$MAJOR_UPDATES" \
             '
             {
               platform: "github",
@@ -135,10 +135,12 @@ jobs:
                   matchManagers: ["gomod", "npm"],
                   groupName: "dependencies",
                   groupSlug: "batch"
-                } + (if $include_major then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
+                } + (if $majors == "batch" then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
                 {matchManagers: ["gomod"], matchDepTypes: ["indirect"], enabled: true},
                 {matchPackageNames: ["typescript"], allowedVersions: "<7"}
               ]
+              # Rules that disable by update type are ignored, but a version cap works.
+              + (if $majors == "ignore" then [{matchManagers: ["gomod", "npm"], allowedVersions: "<{{add major 1}}.0.0"}] else [] end)
             }' > "$CONFIG_FILE"
           jq . "$CONFIG_FILE"
 
diff --git a/README.md b/README.md
index 250ed88..85c7496 100644
--- a/README.md
+++ b/README.md
@@ -104,7 +104,7 @@ jobs:
 
 Daily dependency updates for Go and npm/pnpm/yarn projects, built on Renovate. It replaces `go-autoupdate.yaml`.
 
-1. Renovate puts every minor and patch update (direct and indirect Go modules, npm, pnpm and yarn packages) in one PR on the branch `deps-autoupdate/batch`.
+1. Renovate puts every minor and patch update (direct and indirect Go modules, npm, pnpm and yarn packages) in one PR on the branch `deps-autoupdate/batch`. Major updates are skipped unless `major-updates` says otherwise.
 2. The workflow checks out that branch and runs the tests: `go build`, `go test -race -cover` for Go, and the `package.json` scripts for Node.
 3. If everything passes, it squash-merges the PR. If a test fails, the PR stays open with a comment and Renovate retries on the next run.
 
@@ -140,7 +140,7 @@ The workflow finds `go.mod` and `package.json` itself and tests what exists. A r
 | `node-working-directory` | `.` | Directory that holds `package.json` |
 | `node-scripts` | `lint,typecheck,test,build` | Scripts to run in order. A missing script is skipped. |
 | `require-node-tests` | `true` | Fail when there is no `test` script, so an untested update never merges |
-| `include-major` | `false` | Put major updates in the batch. When `false`, each major gets its own PR that is never merged automatically. |
+| `major-updates` | `ignore` | `ignore` skips major updates. `separate` opens one PR per major that never merges automatically. `batch` puts majors in the batch. |
 | `minimum-release-age` | `2 days` | Skip releases younger than this |
 | `renovate-version` | `44` | Renovate version |
 | `commit-subject` | `chore(deps): update dependencies` | Squash commit subject |