diff --git a/.github/renovate.json b/.github/renovate.json
index cc671aa11..402f0c7a4 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -5,6 +5,14 @@
 	"schedule": ["on friday"],
 	"vulnerabilityAlerts": {
 		"enabled": true,
+		// Default is update-lockfile. For a range with no lockfile entry
+		// (peerDependencies), Renovate then switches that to bump. bump
+		// rewrites each `||` alternative and joins them with spaces, so
+		// `^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0` becomes
+		// `^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16 ^8.0.16` (see #2033).
+		// `auto` widens peers and leaves an in-range peer range unchanged.
+		// Pinned devDependencies still move to the fixed version.
+		"rangeStrategy": "auto",
 	},
 	"osvVulnerabilityAlerts": true,
 	"updateInternalDeps": true,
@@ -21,7 +29,9 @@
 		// Note: Order by least important to most important,
 		// see note at the end of https://docs.renovatebot.com/configuration-options/#packagerules
 
-		// Do not edit peer dependency ranges in package manifests.
+		// Do not edit peer dependency ranges on regular updates.
+		// Security updates re-enable peers; vulnerabilityAlerts.rangeStrategy
+		// above stops those from rewriting `||` ranges.
 		{
 			"matchDepTypes": ["peerDependencies"],
 			"enabled": false,
diff --git a/scripts/sync-lib/renovate.test.js b/scripts/sync-lib/renovate.test.js
index d62dd2cfb..f03f4ddbc 100644
--- a/scripts/sync-lib/renovate.test.js
+++ b/scripts/sync-lib/renovate.test.js
@@ -40,6 +40,19 @@ describe("Renovate configuration", () => {
 		expect(pnpmGroup).toContain('"examples/**"');
 	});
 
+	it("keeps security updates from rewriting peer OR ranges", () => {
+		const alertsStart = config.indexOf('"vulnerabilityAlerts"');
+		const alertsEnd = config.indexOf('"osvVulnerabilityAlerts"');
+		const alerts = config.slice(alertsStart, alertsEnd);
+
+		expect(alertsStart).toBeGreaterThanOrEqual(0);
+		expect(alertsEnd).toBeGreaterThan(alertsStart);
+		expect(alerts).toContain('"enabled": true');
+		// update-lockfile is rewritten to bump for unlocked ranges, which
+		// joins `||` alternatives with spaces. auto widens peers instead.
+		expect(alerts).toContain('"rangeStrategy": "auto"');
+	});
+
 	it("keeps generated examples excluded from Renovate updates", () => {
 		const disableRuleStart = config.indexOf(
 			'"description": "Disable sync-generated example apps"',