diff --git a/renovate.json b/renovate.json
index d36e7fef..8139008f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -29,20 +29,13 @@
     // https://docs.renovatebot.com/presets-default/#automergestablenonmajor
     {
       "groupName": "all stable non-major dependencies",
-      "groupSlug": "all-stable-minor",
+      "groupSlug": "all-stable-minor-patch",
       "matchCurrentVersion": "!/^0/",
       "matchUpdateTypes": [
-        "minor"
-      ],
-      "excludePackageNames": [
-        "git.hamburg.ccc.de/ccchh/oci-images/keycloak"
+        "minor",
+        "patch"
       ]
     },
-    {
-      "matchUpdateTypes": ["patch"],
-      "matchCurrentVersion": "!/^0/",
-      "automerge": true
-    },
     {
       "matchDatasources": ["docker"],
       "matchPackageNames": ["docker.io/pretix/standalone"],
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 01d0b5d6..e77fee26 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -3,6 +3,7 @@
 
 user  nginx;
 worker_processes  auto;
+worker_rlimit_nofile  2050; # should be worker_connections*2 at least
 
 error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;