diff --git a/cmd/dockerflagsgen/go.mod b/cmd/dockerflagsgen/go.mod
index 31a279f..38cff6c 100644
--- a/cmd/dockerflagsgen/go.mod
+++ b/cmd/dockerflagsgen/go.mod
@@ -90,7 +90,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
diff --git a/cmd/dockerflagsgen/go.sum b/cmd/dockerflagsgen/go.sum
index e139486..f38d0fb 100644
--- a/cmd/dockerflagsgen/go.sum
+++ b/cmd/dockerflagsgen/go.sum
@@ -259,8 +259,8 @@ golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/renovate.jsonc b/renovate.jsonc
index b5e1189..ada2ad9 100644
--- a/renovate.jsonc
+++ b/renovate.jsonc
@@ -16,7 +16,9 @@
     ],
     "minimumReleaseAge": null
   },
-  "postUpdateOptions": ["gomodTidy"],
+  // gomodTidyAll, not gomodTidy: cmd/dockerflagsgen replaces the root module with a local path,
+  // so a root go.mod bump leaves its go.mod/go.sum stale until that module is tidied too.
+  "postUpdateOptions": ["gomodTidyAll"],
   "customManagers": [
     {
       "customType": "regex",