diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index acf0b8ff..9d576871 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -72,6 +72,7 @@ Create a fine-grained personal access token: avatar → **Edit profile** →
 | Group and project | Project Planning | Work Item     | Read, Create, Update        |
 | Group and project | Project Planning | Label         | Read                        |
 | Group and project | CI/CD            | Pipeline      | Read                        |
+| Group and project | CI/CD            | Commit Status | Create                      |
 | User              | System Access    | User          | Read                        |
 | Global            | System Access    | Metadata      | Read                        |
 
@@ -91,4 +92,8 @@ just renovate --dry-run jeckersb/base-images  # run against a fork
 
 Commits and MRs will be authored by the token's user rather than the
 `konflux` bot. They use the same branches as the bot (`konflux/mintmaker/*`
-and `renovate/fedora-*/*`), so no duplicate MRs are created.
+and `renovate/fedora-*/*`), so no duplicate MRs are created. On-demand runs
+update the bot's existing MRs, but the bot only tracks MRs it created
+itself, so any new MR opened by an on-demand run stays yours until it is
+merged or closed. On-demand runs never create or update the Dependency
+Dashboard.
diff --git a/Justfile b/Justfile
index 70b7feec..9395b625 100644
--- a/Justfile
+++ b/Justfile
@@ -107,7 +107,10 @@ renovate dry_run="" repo="fedora/bootc/base-images":
         -e RENOVATE_CONFIG_FILE=/config/global.json \
         -e RENOVATE_TOKEN -e RENOVATE_GITHUB_COM_TOKEN \
         -e LOG_LEVEL="${LOG_LEVEL:-info}" \
-        -e RENOVATE_FORCE='{"schedule":[],"updateNotScheduled":true}' \
+        -e RENOVATE_ALLOW_SHELL_EXECUTOR_FOR_POST_UPGRADE_COMMANDS=true \
+        -e RENOVATE_EXECUTION_TIMEOUT=40 \
+        -e RENOVATE_IGNORE_PR_AUTHOR=true \
+        -e RENOVATE_FORCE='{"schedule":[],"updateNotScheduled":true,"dependencyDashboard":false}' \
         {{renovate_image}} \
         renovate --platform=gitlab --endpoint=https://gitlab.com/api/v4 \
         {{if dry_run != "" { "--dry-run=full" } else { "" }}} {{repo}}