diff --git a/Dockerfile b/Dockerfile
index fe5d0b2..2351a29 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
-# Renovate bumps the zola pin; flake.nix (used by the tests) tracks nixpkgs.
-FROM ghcr.io/getzola/zola:v0.23.6 AS build
+# Keep in step with the zola in flake.nix (tests, local serve); Renovate
+# leaves this pin alone (renovate.json). 0.23 changes config.toml.
+FROM ghcr.io/getzola/zola:v0.22.1 AS build
 
 COPY . /project
 WORKDIR /project
-# The image has no zola on PATH since 0.23 (/bin/zola moved to /zola)
-RUN ["/zola", "build"]
+RUN ["zola", "build"]
 
 FROM nginx:1.28-alpine
 
diff --git a/renovate.json b/renovate.json
index 064dbcd..7f431e1 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,14 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "local>asxpi/renovate"
+  ],
+  "packageRules": [
+    {
+      "description": "zola must match the flake's (tests, local serve): bump both by hand, and migrate config.toml for 0.23 ([markdown.highlighting] lost `enabled`)",
+      "matchPackageNames": [
+        "ghcr.io/getzola/zola"
+      ],
+      "enabled": false
+    }
   ]
 }