diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index fd98496..9aac89b 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -34,5 +34,5 @@ jobs:
           LOG_LEVEL: info
           RENOVATE_REPOSITORIES: ${{ github.repository }}
           RENOVATE_GIT_AUTHOR: "onion-4-dinner <15676555+onion-4-dinner@users.noreply.github.com>"
-          # Allow postUpgradeTasks commands defined in renovate.json5.
-          RENOVATE_ALLOW_POST_UPGRADE_COMMANDS: "true"
+          # Whitelist postUpgradeTasks commands defined in renovate.json5.
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^go generate \\./\\.\\.\\.$$"]'